CVE-2026-49853
published 2026-07-14CVE-2026-49853: Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed…
PriorityP345high7.7CVSS 3.1
AVNACLPRLUINSCCHINAN
EPSS
0.45%
37.7th percentile
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-26 | lightspeed-chatbot-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-chatbot-rhel9 | — | — |
| clusterlabs | pcs | — | — |
| debian | python-tornado | — | — |
| keylime | keylime | — | — |
| mta | mta-solution-server-rhel9 | — | — |
| rhosp-rhel8 | openstack-cinder-backup | — | — |
| rhosp-rhel8 | openstack-cinder-volume | — | — |
| rhosp-rhel8 | openstack-haproxy | — | — |
| rhosp-rhel8 | openstack-manila-share | — | — |
| rhosp-rhel8 | openstack-mariadb | — | — |
| rhosp-rhel8 | openstack-ovn-northd | — | — |
| rhosp-rhel8 | openstack-rabbitmq | — | — |
| rhosp-rhel8 | openstack-redis | — | — |
| tornadoweb | tornado | < 6.5.6 | 6.5.6 |
| tornadoweb | tornado | >= 0 < 6.5.6 | 6.5.6 |
CVSS provenance
nvdv3.17.7HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
vendor_redhat7.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects
vendor_redhat·2026-07-14·CVSS 7.7
CVE-2026-49853 [HIGH] CWE-201 tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects
tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote attacker to gain unauthorized access to a user's credentials,
GHSA
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
ghsa·2026-06-15
CVE-2026-49853 [HIGH] CWE-200 Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
## Summary
When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin.
As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default.
Beginning in Tornado 6.5.6, `SimpleAsyncHTTPClient` matches the default behavior of `libcurl` (and therefore `CurlAsyncHTTPClient`): When a redirect changes the scheme, host, or port of the url, the `Authorization` and `Cookie` headers will be removed when follo
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-49853 python-flit: Tornado: Information disclosure via improper handling of credentials during HTTP redirects [fedora-all]
bugzilla·2026-08-24·CVSS 7.7
CVE-2026-49853 [HIGH] CVE-2026-49853 python-flit: Tornado: Information disclosure via improper handling of credentials during HTTP redirects [fedora-all]
CVE-2026-49853 python-flit: Tornado: Information disclosure via improper handling of credentials during HTTP redirects [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
Bugzilla
CVE-2026-49853 python-pep517: Tornado: Information disclosure via improper handling of credentials during HTTP redirects [epel-all]
bugzilla·2026-08-24·CVSS 7.7
CVE-2026-49853 [HIGH] CVE-2026-49853 python-pep517: Tornado: Information disclosure via improper handling of credentials during HTTP redirects [epel-all]
CVE-2026-49853 python-pep517: Tornado: Information disclosure via improper handling of credentials during HTTP redirects [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
Bugzilla
CVE-2026-49853 python-flit: Tornado: Information disclosure via improper handling of credentials during HTTP redirects [epel-all]
bugzilla·2026-08-24·CVSS 7.7
CVE-2026-49853 [HIGH] CVE-2026-49853 python-flit: Tornado: Information disclosure via improper handling of credentials during HTTP redirects [epel-all]
CVE-2026-49853 python-flit: Tornado: Information disclosure via improper handling of credentials during HTTP redirects [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
Bugzilla
CVE-2026-49853 tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects
bugzilla·2026-07-14·CVSS 7.7
CVE-2026-49853 [HIGH] CVE-2026-49853 tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects
CVE-2026-49853 tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
2026-07-14
Published