CVE-2026-49853

What it actually does

The vulnerability allows authentication credentials (Authorization headers, usernames, passwords, and auth modes) to be sent to unintended hosts during HTTP redirects that change the scheme, host, or port, because only the Host header is stripped from shallow-copied request objects.

Why it matters to the business

Organizations using affected Tornado versions risk leaking sensitive credentials to third-party servers if their applications follow redirects, potentially leading to unauthorized access or data breaches.

How an attack unfolds

An attacker configures a server to issue a redirect response that points to a different origin. When a Tornado client using SimpleAsyncHTTPClient makes an authenticated request that follows the redirect, the credentials are included in the new request to the attacker's server.

How to fix it

Upgrade Tornado to version 6.5.6 or later to ensure proper handling of authentication headers during redirects.

How to confirm the fix worked

Verify the installed Tornado version is 6.5.6 or higher. Test redirect scenarios with authentication to confirm credentials are not leaked.

Typical attack path

1. Identify an application using Tornado's SimpleAsyncHTTPClient with authentication.
2. Set up a redirect from a trusted endpoint to an attacker-controlled server.
3. Trigger the authenticated request that follows the redirect.
4. Capture the leaked Authorization headers or credentials on the attacker server.

How to detect it

Monitor application logs for HTTP requests involving redirects where authentication headers are present; look for requests to unexpected domains carrying auth info.

What your security team should do

• Upgrade all Tornado installations to 6.5.6 or newer immediately.
• Review and audit code using SimpleAsyncHTTPClient for authentication usage.
• Implement network monitoring for unexpected credential transmissions.