CVE-2026-116578

A flaw was found in Tornado. When an application configures RedirectHandler with dynamic URL templates, user-controlled input in request paths can alter the target redirect scheme or host location. A remote attacker can exploit this vulnerability by sending a crafted request to trigger an open redirect, redirecting users to an arbitrary external website. This flaw can be leveraged in phishing attacks to trick users into visiting malicious destinations while appearing to interact with a trusted domain.

Red Hat has evaluated this vulnerability as Moderate because exploitation requires victim interaction through deceptive links and is constrained to specific routing configurations using dynamic redirection handlers. Typical Red Hat product deployments utilize Tornado within internal or managed backend services without exposing vulnerable URL redirect patterns. Because the vulnerability cannot lead to unauthorized host access, data leakage, or service disruption, the practical risk is largely confined to client-side phishing scenarios.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Upgrade tornado to 6.6. Avoid regex-capture substitutions in the scheme/netloc or start-of-path placement of RedirectHandler url templates; tornado 6.6 rejects such requests with HTTP 400.