Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2026-91991Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs

Medium 5.4

In plain English

A medium-severity security flaw in tornado from tornadoweb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.2%top 83.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	python-tornado	no fix listed	DEBIAN-CVE-2026-91991
Debian:14	python-tornado	no fix listed	DEBIAN-CVE-2026-91991
PyPI	tornado	6.5.8	GHSA-wwv5-g3v4-889x
Ubuntu:24.04:LTS	python-tornado	no fix listed	UBUNTU-CVE-2026-91991
Ubuntu:26.04:LTS	python-tornado	no fix listed	UBUNTU-CVE-2026-91991
Ubuntu:26.10	python-tornado	no fix listed	UBUNTU-CVE-2026-91991

Affected products (as reported)

Vendor	Product	Versions
tornadoweb	tornado	6.5.5 – before 6.5.8

Weakness: CWE-113 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-wwv5-g3v4-889x) vendor-advisory
VulnCheck Advisory: Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs third-party-advisory