CVE-2026-49853
highpriority · track · 0EPSS 0.004 · 38 %ileDEEUUSEPSS · scored 2026-10-22
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (6)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux tornadoall versionscert_bundDEcpe:/o:redhat:enterprise_linux:python-tornado__6.4.2
advisories (3)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-3870Red Hat Enterprise Linux (python-tornado): Mehrere SchwachstellenDeutsch2026-10-11csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in python-tornado in Red Hat Enterprise Linux ausnutzen, um Informationen offenzulegen oder einen Denial of Service zu verursachen
- GHSA-3x9g-8vmp-wqvfTornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient2026-06-15ghsa · osvUS
## Summary When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin. As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default. Beginning in Tornado 6.5.6, `SimpleAsyncHTTPClient` matches the default behavior of `libcurl` (and therefore `CurlAsyncHTTPClient`): When a redirect changes the scheme, host, or port of the url, the `Authorization` and `Cookie` headers will be removed when following the redirect.
- PYSEC-2026-3387Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient2026-07-13vendor · osvUS
## Summary When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements max_redirects, and removes only the Host header. It does not clear Authorization, auth_username, auth_password, or auth_mode when the redirect target changes origin. As a result, credentials intended for one origin can be forwarded to a different origin when follow_redirects=True, which is the default. Beginning in Tornado 6.5.6, `SimpleAsyncHTTPClient` matches the default behavior of `libcurl` (and therefore `CurlAsyncHTTPClient`): When a redirect changes the scheme, host, or port of the url, the `Authorization` and `Cookie` headers will be removed when following the redirect.
also known as (6)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (13)
External citations — patches, advisories, analysis.
- https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751cnnvd
- https://github.com/tornadoweb/tornado/pull/3626cnnvd
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.6cnnvd
- https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvfcnnvd
- https://www.tornadoweb.org/Patchcnnvd
- https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751enisa_euvd
- https://github.com/tornadoweb/tornado/pull/3626enisa_euvd
- https://github.com/tornadoweb/tornado/releases/tag/v6.5.6enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan