CVE-2026-126347: Tornado: Open redirect via triple-slash redirect paths
Tornado is a Python web framework and asynchronous networking library. In versions through 6.6.0, applications using tornado.web.RedirectHandler with URL templates that allow attacker-controlled substitutions to influence the destination can be vulnerable to an open redirect using three or more leading slashes. Differences between Python’s URL parsing and browser URL interpretation allow a crafted destination to redirect a user to an attacker-controlled host. The remediation for CVE-2026-116578 in version 6.6.0 did not fully address this case. This issue is fixed in version 6.6.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Tornadoto a version that resolves this vulnerability.Fixed in 6.6.1
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using tornado.web.RedirectHandler are exposed only when their URL templates allow attacker-controlled substitutions to influence the redirect destination. Tornado versions through 6.6.0 are affected under those conditions.
What must an attacker do to exploit it?
An attacker must be able to supply or influence a value used in the redirect destination. They can use a destination beginning with three or more slashes so that browser URL interpretation redirects the user to an attacker-controlled host.
Is upgrading to Tornado 6.6.0 sufficient?
No. The remediation in version 6.6.0 for CVE-2026-116578 did not fully address this triple-slash case. The issue is fixed in Tornado 6.6.1.