CVE-2026-116578

What it actually does

Tornado's RedirectHandler permits regex capture groups in URL templates to inject attacker-controlled values at the start of a path, immediately after a host, or at the template beginning, allowing protocol-relative, absolute, or host-extension redirects that browsers treat as external destinations.

Why it matters to the business

Attackers can trick users into visiting malicious sites while the link appears to come from a trusted application domain, increasing successful phishing and eroding user trust without requiring authentication or code execution.

How an attack unfolds

An attacker identifies a RedirectHandler route that uses a vulnerable template placement, crafts a request whose path contains a capture substitution that alters the redirect target to an attacker-controlled scheme or host, and delivers the resulting link via phishing to cause the victim browser to follow the open redirect.

How to fix it

Upgrade Tornado to version 6.6 or later. Review all RedirectHandler route definitions and replace any templates that permit substitutions at the start of a path or immediately after a host with static templates or patterns that enforce a leading slash after the host.

How to confirm the fix worked

Confirm the installed Tornado version is 6.6 or newer. Test RedirectHandler routes with crafted paths containing leading substitutions and verify that redirects remain within the intended domain and scheme.

Typical attack path

1. Map application routes to locate RedirectHandler instances using vulnerable template patterns
2. Craft a request path containing a regex capture that places an attacker-controlled value at the start, after the host, or at the template root
3. Deliver the resulting link to a victim through phishing or other social engineering
4. Victim browser follows the redirect to an attacker-controlled destination

How to detect it

Review web server and application logs for redirect responses containing unexpected external hosts, protocol-relative URLs, or backslash-prefixed locations originating from RedirectHandler routes. Correlate with user-agent strings or referrers associated with phishing campaigns.

What your security team should do

• Prioritize upgrade of all Tornado installations to 6.6 within the next maintenance window
• Audit application route configurations for any use of RedirectHandler with dynamic path templates
• Add web application firewall rules that block requests containing protocol-relative or absolute redirect targets in known redirect paths
• Monitor for unexpected external redirects in application logs