Summary
Tornado: Open redirect in RedirectHandler via protocol-relative URLs
tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing.
Workarounds
- Change
RedirectHandlertemplates so every substitution comes after a fixed prefix ending in/, or write capture-group regexes that cannot match characters such as/,\,@,.or:where they could affect the host. - Alternatively, replace
RedirectHandlerwith a custom handler that validates the target before callingself.redirect().
Credit
Reported by Longwei Wang (@gn00295120).
Impact
Applications are affected if they use RedirectHandler with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes:
- A substitution at the start of the path, for example
(r"/(.*)/target", RedirectHandler, {"url": "/{0}/destination"}). A request tohttps://example.com//evil.com/targetredirects to//evil.com/destination, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to//. - A substitution directly after the host, for example
(r"/old(.*)", RedirectHandler, {"url": "https://new.example.com{0}"}). A request to/old.evil.com/or/[email protected]/redirects to evil.com. - A template that begins with a substitution (such as
"{0}"), which can be given an absolute URL.
Applications are not affected if their RedirectHandler templates use only static URLs, or if every substitution comes after a fixed host and a / (for example "/static/{0}" or "https://example.com/{0}"). Other uses of RequestHandler.redirect() are not affected by this advisory, although applications that pass user-controlled input to redirect() should validate it themselves.
Untrusted input controls a URL used for redirection, which can forward users to attacker-controlled sites. Typical impact: phishing and credential harvesting via a trusted domain.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Fixed in Tornado 6.6. RedirectHandler now returns a 400 error if the substituted values would change the scheme or host of the redirect from what the template specifies. As a result, substitutions can no longer be used in the scheme or host part of a template. The similar check in StaticFileHandler has also been hardened against backslash and whitespace variants.
Frequently Asked Questions
- What is CVE-2026-116578? CVE-2026-116578 is a low-severity open redirect vulnerability in tornado (pip), affecting versions < 6.6. It is fixed in 6.6. Untrusted input controls a URL used for redirection, which can forward users to attacker-controlled sites.
- Which versions of tornado are affected by CVE-2026-116578? tornado (pip) versions < 6.6 is affected.
- Is there a fix for CVE-2026-116578? Yes. CVE-2026-116578 is fixed in 6.6. Upgrade to this version or later.
- Is CVE-2026-116578 exploitable, and should I be worried? Whether CVE-2026-116578 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-116578 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-116578? Upgrade
tornadoto 6.6 or later.