Open Redirect Vulnerability in Tornado Python Web Framework
CVE-2026-126347

3.1LOW

Key Information:

Vendor

Tornadoweb

Status
Tornado
Vendor
CVE Published:
12 November 2026

What is CVE-2026-126347?

The Tornado web framework versions prior to 6.6.1 are susceptible to an open redirect vulnerability. This issue occurs when applications utilizing tornado.web.RedirectHandler have URL templates that permit attacker-controlled substitutions. Such configurations can lead to manipulation of the destination URL, allowing an attacker to redirect users to malicious sites. The flaw stems from discrepancies between Python's URL parsing and how browsers interpret URLs, specifically with the handling of multiple leading slashes. Users are advised to upgrade to version 6.6.1 where this vulnerability has been addressed.

Affected Version(s)

tornado < 6.6.1

References

https://github.com/tornadoweb/tornado/security/advisories...
x_refsource_CONFIRM
https://github.com/tornadoweb/tornado/commit/c503241622c0...
x_refsource_MISC

CVSS V3.1

Score:
3.1
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.