Log in Start free

Vulnerability · Published Jul 14, 2026 · Assigned by GitHub_M

CVE-2026-49853Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

High 7.7

In plain English

A high-severity information exposure in tornado from tornadoweb. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.7High
Exploit odds (30 days)0.4%top 61.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10python3-tornado6.5.8-0.el10_2.1ALSA-2026:67147
AlmaLinux:9python3-tornado6.5.8-0.el9_8.1ALSA-2026:67146
Debian:12python-tornadono fix listedDEBIAN-CVE-2026-49853
Debian:13python-tornadono fix listedDEBIAN-CVE-2026-49853
Debian:14python-tornadono fix listedDEBIAN-CVE-2026-49853
PyPItornado6.5.6GHSA-3x9g-8vmp-wqvf
PyPItornado6.5.6PYSEC-2026-3387
Rocky Linux:10python-tornado0:6.5.8-0.el10_2.1RLSA-2026:67147
Rocky Linux:9python-tornado0:6.5.8-0.el9_8.1RLSA-2026:67146
Ubuntu:24.04:LTSpython-tornadono fix listedUBUNTU-CVE-2026-49853
Ubuntu:26.04:LTSpython-tornadono fix listedUBUNTU-CVE-2026-49853
Ubuntu:26.10python-tornadono fix listedUBUNTU-CVE-2026-49853

Affected products (as reported)

VendorProductVersions
tornadoweb tornado < 6.5.6

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References