CVE-2026-49853: Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
Summary
When SimpleAsyncHTTPClient follows a 3xx redirect, it shallow-copies the original HTTPRequest, rewrites the URL, decrements maxredirects, and removes only the Host header. It does not clear Authorization, authusername, authpassword, or authmode when the redirect target changes origin.
As a result, credentials intended for one origin can be forwarded to a different origin when followredirects=True, which is the default.
Beginning in Tornado 6.5.6, SimpleAsyncHTTPClient matches the default behavior of libcurl (and therefore CurlAsyncHTTPClient): When a redirect changes the scheme, host, or port of the url, the Authorization and Cookie headers will be removed when following the redirect.
Other sources
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, authusername, authpassword, and authmode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/tornadoto a version that resolves this vulnerability.Fixed in 6.5.6 - Upgrade
Upgrade
tornado/SimpleAsyncHTTPClientto a version that resolves this vulnerability.Fixed in 6.5.6
Event History
Frequently Asked Questions
What is the severity of CVE-2026-49853?
The severity of CVE-2026-49853 is high with a score of 7.7.
What types of information can be leaked due to CVE-2026-49853?
CVE-2026-49853 may leak sensitive information such as authorization credentials when following a redirect.
How do I fix CVE-2026-49853?
To mitigate CVE-2026-49853, ensure that all authorization headers are cleared before processing redirects to a different origin.
Which software is affected by CVE-2026-49853?
CVE-2026-49853 affects the pip and tornado software packages.
When was CVE-2026-49853 published?
CVE-2026-49853 was published on June 15, 2026.