CVE-2026-116578 tornadoweb CVE debrief

Who should care

Defenders of applications using Tornado's RedirectHandler should assess exposure and prioritize remediation to prevent potential phishing attacks. This includes verifying affected deployments, reviewing vendor guidance, and adjusting URL templates in RedirectHandler. Security teams and operators should review and adjust configurations to prevent exploitation.

Why it matters

CVE-2026-116578 is an open redirect vulnerability in Tornado's RedirectHandler that can be exploited for phishing attacks. Defenders of applications using this handler must assess exposure and prioritize remediation.

• Phishing campaigns can be amplified using the open redirect
• Attackers can redirect users to malicious sites
• Defenders must verify and remediate affected deployments
• Vulnerable configurations require immediate review and adjustment

Technical summary

The vulnerability exists in Tornado's RedirectHandler, which builds target URLs by substituting parts of the request path into a template. An attacker can craft a request that redirects to a host of their choosing by exploiting substitutions at the start of the path, directly after the host, or in templates that begin with a substitution. This allows for open redirect attacks, potentially leading to phishing campaigns. Affected applications use RedirectHandler with URL templates where regex capture groups influence the scheme or host of the redirect.

Defensive priority

Defenders should prioritize verifying and remediating affected Tornado deployments, especially those using RedirectHandler with vulnerable URL templates.

Recommended defensive actions

• Verify Tornado deployments for vulnerable RedirectHandler configurations
• Update Tornado to version 6.6.0 or later
• Monitor for suspicious redirect activity
• Review and adjust URL templates in RedirectHandler
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability is confirmed in Tornado versions before 6.6.0. Official sources include CVE Program, NVD, and Tornado's advisory. Evidence limits are based on available information from these sources. Defenders should verify affected deployments and review vendor guidance for remediation. The open redirect can be exploited for phishing attacks by redirecting users to malicious sites.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.