{"schema":"threatline.record/2","record":{"id":"CVE-2026-116578","aliases":["GHSA-pw9p-v7r6-gx4p"],"summary":"Tornado: Open redirect in RedirectHandler via protocol-relative URLs","details":"Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.","categories":["Unclassified"],"product":"tornado","vendor":"tornadoweb","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-116578","source_modified_at":"2026-10-26T20:22:32.217Z","fetched_at":"2026-10-26T23:45:56.352924Z","product":"tornado","vendor":"tornadoweb","versions":[{"version":"< 6.6","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":2.1,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-26T20:22:32.217Z","modified_at":"2026-10-26T20:22:32.217Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-116578","fetched_at":"2026-10-26T23:45:56.352924Z","source_modified_at":"2026-10-26T20:22:32.217Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw9p-v7r6-gx4p","tags":["x_refsource_CONFIRM"]},{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/pull/3786","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/commit/940ea725bdd9bc68231d68a105eef17ea6e11233","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/commit/cc75ab0eb3af459c714895a49f682ad354f50117","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/commit/ccb6a2e5482f17997efd4a74b8200d5b4babc035","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/tornadoweb/tornado/releases/tag/v6.6.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-26T20:22:32.217Z","content_hash":"3cba31d45aef2a45f755b243e279c7658e8d8312be6f1a23d2f1dfb707684ba6"}}