{"id":"CVE-2026-116578","aliases":["GHSA-pw9p-v7r6-gx4p"],"title":"Tornado: Open redirect in RedirectHandler via protocol-relative URLs","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"LOW","description":"### Summary\n\n`tornado.web.RedirectHandler` builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing.\n\n### Impact\n\nApplications are affected if they use `RedirectHandler` with a URL template where a regex capture group can influence the scheme or host of the redirect. This includes:\n\n- **A substitution at the start of the path**, for example `(r\"/(.*)/target\", RedirectHandler, {\"url\": \"/{0}/destination\"})`. A request to `https://example.com//evil.com/target` redirects to `//evil.com/destination`, a protocol-relative URL pointing to evil.com. Variants using backslashes or encoded characters have the same effect, because browsers treat them as equivalent to `//`.\n- **A substitution directly after the host**, for example `(r\"/old(.*)\", RedirectHandler, {\"url\": \"https://new.example.com{0}\"})`. A request to `/old.evil.com/` or `/old@evil.com/` redirects to evil.com.\n- **A template that begins with a substitution** (such as `\"{0}\"`), which can be given an absolute URL.\n\nApplications are not affected if their `RedirectHandler` templates use only static URLs, or if every substitution comes after a fixed host and a `/` (for example `\"/static/{0}\"` or `\"https://example.com/{0}\"`). Other uses of `RequestHandler.redirect()` are not affected by this advisory, although applications that pass user-controlled input to `redirect()` should validate it themselves.\n\n### Patches\n\nFixed in Tornado 6.6. `RedirectHandler` now returns a 400 error if the substituted values would change the scheme or host of the redirect from what the template specifies. As a result, substitutions can no longer be used in the scheme or host part of a template. The similar check in `StaticFileHandler` has also been hardened against backslash and whitespace variants.\n\n### Workarounds\n\n- Change `RedirectHandler` templates so every substitution comes after a fixed prefix ending in `/`, or write capture-group regexes that cannot match characters such as `/`, `\\`, `@`, `.` or `:` where they could affect the host.\n- Alternatively, replace `RedirectHandler` with a custom handler that validates the target before calling `self.redirect()`.\n\n### Credit\n\nReported by Longwei Wang (@gn00295120).","severity":"low","score":2.1,"published":"2026-10-26T20:22:32.217Z","modified":"2026-10-28T23:00:04.066Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"tornado","sources":[{"name":"OSV · GHSA-pw9p-v7r6-gx4p","url":"https://osv.dev/vulnerability/GHSA-pw9p-v7r6-gx4p"}],"ranges":[{"events":[{"introduced":"0"},{"fixed":"6.6"}],"type":"ECOSYSTEM"}],"versions":["0.2","1.0","1.1","1.1.1","1.2","1.2.1","2.0","2.1","2.1.1","2.2","2.2.1","2.3","2.4","2.4.1","3.0","3.0.1","3.0.2","3.1","3.1.1","3.2","3.2.1","3.2.2","4.0","4.0.1","4.0.2","4.1","4.1b2","4.2","4.2.1","4.2b1","4.3","4.3b1","4.3b2","4.4","4.4.1","4.4.2","4.4.3","4.4b1","4.5","4.5.1","4.5.2","4.5.3","4.5b1","4.5b2","5.0","5.0.1","5.0.2","5.0a1","5.0b1","5.1","5.1.1","5.1b1","6.0","6.0.1","6.0.2","6.0.3","6.0.4","6.0a1","6.0b1","6.1","6.1b1","6.1b2","6.2","6.2b1","6.2b2","6.3","6.3.1","6.3.2","6.3.3","6.3b1","6.4","6.4.1","6.4.2","6.4b1","6.5","6.5.1","6.5.10","6.5.2","6.5.3","6.5.4","6.5.5","6.5.6","6.5.7","6.5.8","6.5.9","6.5b1","6.6a1","6.6b1","6.6rc1"],"fixed":["6.6"]}],"sourceAffected":[],"references":["https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p","https://github.com/tornadoweb/tornado/pull/3786","https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233","https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117","https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035","https://github.com/tornadoweb/tornado/releases/tag/v6.6.0","https://nvd.nist.gov/vuln/detail/CVE-2026-116578","https://github.com/tornadoweb/tornado"],"sources":[{"name":"CVE","id":"CVE-2026-116578","modified":"2026-10-26T20:22:32.217Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-116578"},{"name":"OSV","id":"GHSA-pw9p-v7r6-gx4p","modified":"2026-10-28T23:00:04.066537287Z","url":"https://osv.dev/vulnerability/GHSA-pw9p-v7r6-gx4p"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","score":2.1},{"source":"OSV","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","score":2.1}],"products":[{"vendor":"tornadoweb","name":"tornado","platforms":[],"versions":[{"version":"< 6.6","status":"affected"}],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-116578"}],"remediation":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T04:15:31.644Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T23:20:39.555Z","attemptedAt":"2026-10-28T23:20:39.555Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T23:20:40.284Z","attemptedAt":"2026-10-28T23:20:40.284Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T23:20:40.608Z","attemptedAt":"2026-10-28T23:20:40.608Z"},{"source":"EPSS","status":"available","checkedAt":"2026-10-28T23:20:40.376Z","attemptedAt":"2026-10-28T23:20:40.376Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-116578","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116578","modified":"2026-10-26T21:18:15.077","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-10-28T23:20:39.555Z"},{"source":"GitHub Advisory Database","id":"GHSA-pw9p-v7r6-gx4p","url":"https://github.com/advisories/GHSA-pw9p-v7r6-gx4p","modified":"2026-10-28T22:43:46Z","checkedAt":"2026-10-28T23:20:40.284Z"},{"source":"FIRST EPSS","id":"CVE-2026-116578","url":"https://www.first.org/epss/","probability":0.00459,"percentile":0.39655,"date":"2026-10-28","checkedAt":"2026-10-28T23:20:40.376Z"},{"source":"ENISA EUVD","id":"EUVD-2026-110319","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-110319","modified":"Oct 28, 2026, 10:43:45 PM","score":2.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","checkedAt":"2026-10-28T23:20:40.608Z"}]}