CVE-2026-498537.7HighCWE-200
Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient
tornadoweb · tornado
Not in CISA KEV
0.5%probability of exploitation in the next 30 days
38th percentile
050100
Higher than 38% of scored CVEs
7.7HighCVSS 3.1
LowMediumHighCrit.
DescriptionNVD
Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 16 Jun.
- Tornado fixes credential leak in redirect, urges immediate updateSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.