Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck
CVE-2026-91992Tornado before 6.5.7 Credential Leak via Handle Reuse
Medium 5.9
In plain English
A medium-severity information exposure in tornado from tornadoweb. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-tornado | no fix listed | DEBIAN-CVE-2026-91992 |
| Debian:13 | python-tornado | no fix listed | DEBIAN-CVE-2026-91992 |
| Debian:14 | python-tornado | no fix listed | DEBIAN-CVE-2026-91992 |
| PyPI | tornado | 6.5.7 | GHSA-pw6j-qg29-8w7f |
| Ubuntu:24.04:LTS | python-tornado | 6.4.0-1ubuntu0.6 | UBUNTU-CVE-2026-91992 |
| Ubuntu:24.04:LTS | python-tornado | 6.4.0-1ubuntu0.6 | USN-8952-1 |
| Ubuntu:26.04:LTS | python-tornado | 6.5.4-0.1ubuntu0.2 | USN-8952-1 |
| Ubuntu:26.04:LTS | python-tornado | 6.5.4-0.1ubuntu0.2 | UBUNTU-CVE-2026-91992 |
| Ubuntu:26.10 | python-tornado | 6.5.5-5ubuntu1.1 | USN-8952-1 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| tornadoweb | tornado | 0 – before 6.5.7 |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-pw6j-qg29-8w7f) vendor-advisory
- VulnCheck Advisory: Tornado before 6.5.7 Credential Leak via Handle Reuse third-party-advisory