CVE-2026-116578: Tornado: Open redirect in RedirectHandler via protocol-relative URLs
tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application’s domain, which can be used in phishing.
References
- github.com/advisories/GHSA-pw9p-v7r6-gx4p
- github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233
- github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117
- github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035
- github.com/tornadoweb/tornado/pull/3786
- github.com/tornadoweb/tornado/releases/tag/v6.6.0
- github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p
- nvd.nist.gov/vuln/detail/CVE-2026-116578
Code Behaviors & Features
Detect and mitigate CVE-2026-116578 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →