CVE-2026-116578: 
Python vulnerability analysis and mitigation

CVE-2026-116578 is an open redirect vulnerability in the tornado.web.RedirectHandler component of the Tornado Python web framework. Affecting all versions prior to 6.6, the flaw allows attackers to craft request paths that manipulate regex-capture substitutions in URL templates, causing redirects to attacker-controlled destinations. The vulnerability was reported by Longwei Wang (@gn00295120), published on October 26, 2026, and fixed in Tornado 6.6.0. It carries a CVSS v4.0 base score of 2.1 (Low) (GitHub Advisory, Feedly).

The root cause is improper neutralization of user-controlled input in URL redirect logic (CWE-601). RedirectHandler builds its target URL by substituting regex capture groups from the request path into a URL template; when substitutions appear at the start of the path, directly after a fixed host without a trailing slash, or at the beginning of the template, an attacker can inject values that alter the scheme or network location of the redirect. Browsers interpret variants such as protocol-relative URLs (//evil.com), backslash-encoded paths (/\evil.com, /%5Cevil.com), tab/newline-encoded sequences, host-extension payloads (e.g., /old.evil.com/), and user-info payloads (e.g., /old@evil.com/) as redirects to attacker-controlled hosts, because path arguments are URL-decoded before substitution. Static templates and substitutions that appear after a fixed host followed by a / are not affected (GitHub Advisory, PR #3786).

Successful exploitation enables an attacker to abuse the trusted domain of a Tornado-based application to redirect users to arbitrary external sites, facilitating phishing campaigns, credential harvesting, and social engineering attacks. The vulnerability has no direct impact on confidentiality or availability of the server itself, but the integrity of the redirect destination is compromised, potentially exposing end users to malicious content under the guise of a legitimate domain. The CVSS v4.0 assessment reflects a low system integrity impact limited to the subsidiary (browser-side) context (GitHub Advisory, Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating very low probability of near-term exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction (a victim must follow the crafted redirect link) and specific application configurations using vulnerable RedirectHandler URL templates (Feedly, GitHub Advisory).

1. Reconnaissance: Identify web applications built on Tornado (versions < 6.6) that use RedirectHandler with URL templates containing regex capture groups, e.g., (r"/(.*)/target", RedirectHandler, {"url": "/{0}/destination"}).
2. Identify vulnerable template pattern: Determine if the substitution appears at the start of the path, directly after a fixed host without a trailing slash, or at the beginning of the template — these are the exploitable placements.
3. Craft malicious request: Construct a request path that injects a protocol-relative or absolute URL into the capture group. For example, for template /{0}/destination, request //evil.com/target to produce a redirect to //evil.com/destination. Alternatively, use percent-encoded variants such as /%5Cevil.com/target (backslash) or /%09/evil.com/target (tab) to bypass naive checks.
4. Deliver phishing link: Share the crafted URL (e.g., https://legitimate-app.example.com//evil.com/target) with victims. The server issues a redirect to the attacker-controlled host, while the link appears to originate from the trusted domain.
5. Harvest credentials or deliver malware: The victim is redirected to the attacker's site, which may mimic the legitimate application to steal credentials or deliver malicious payloads (GitHub Advisory, PR #3786).

• Network: HTTP requests to Tornado application endpoints with paths beginning with //, /%5C, /%09, or other encoded double-slash/backslash variants (e.g., GET //evil.com/path HTTP/1.1); HTTP 3xx redirect responses with Location headers pointing to unexpected external hosts.
• Logs: Web server access logs showing requests with URL-encoded backslashes or double slashes in the path component targeting RedirectHandler routes; log entries containing Redirect URL cannot change the scheme or netloc (generated by patched versions when blocking exploit attempts).
• Logs: Requests to paths matching patterns like /<capture>//external.com/..., /moved.evil.com/..., /moved@evil.com/..., or /any/https://evil.com/ in application access logs.

Upgrade Tornado to version 6.6.0 or later, which fixes the issue by requiring that the scheme and netloc of the redirect destination match those of the template (formatted with placeholder values), returning HTTP 400 for any request that would change them (GitHub Advisory, Tornado Release). As a workaround without upgrading, modify RedirectHandler templates so that every substitution appears after a fixed prefix ending in / (e.g., "/static/{0}" or "https://example.com/{0}"), or restrict capture-group regexes to exclude characters such as /, \, @, ., and : that could affect the host. Alternatively, replace RedirectHandler with a custom handler that validates the redirect target before calling self.redirect() (GitHub Advisory).

The vulnerability was disclosed by maintainer bdarnell via a GitHub Security Advisory on October 22, 2026, crediting reporter Longwei Wang (@gn00295120). The fix was developed with assistance from Claude Opus 5.5 as noted in the commit messages, which drew some community attention to AI-assisted security patching. No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified (GitHub Advisory, PR #3786).