CVE-2026-49853: Tornado Framework Information Disclosure

CVE-2026-49853 Overview

CVE-2026-49853 is an information disclosure vulnerability in Tornado, a Python web framework and asynchronous networking library. The SimpleAsyncHTTPClient shallow-copied redirected requests and stripped only the Host header when following redirects. When a redirect changed scheme, host, or port, sensitive fields including Authorization, auth_username, auth_password, and auth_mode were forwarded to the new origin. This allowed attacker-controlled endpoints to receive credentials intended for the original service. The issue is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor and is resolved in Tornado version 6.5.6.

Critical Impact
Applications using SimpleAsyncHTTPClient with authenticated outbound requests may leak bearer tokens, basic auth credentials, or session identifiers to unintended hosts when following HTTP redirects across origins.

Affected Products

Tornado web framework versions prior to 6.5.6
Python applications using tornado.simple_httpclient.SimpleAsyncHTTPClient
Services relying on Tornado's default AsyncHTTPClient implementation with follow_redirects=True

Discovery Timeline

2026-05-27 - Tornado 6.5.6 released with security fix
2026-07-14 - CVE-2026-49853 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-49853

Vulnerability Analysis

The vulnerability resides in the redirect handling logic of SimpleAsyncHTTPClient. When Tornado receives an HTTP 3xx response and follow_redirects is enabled, the client constructs a new request by shallow-copying the original HTTPRequest object. The redirect logic explicitly removed the Host header but failed to strip authentication-related fields.

As a result, credentials attached to the original request were replayed against the redirect target, even when the target belonged to a different scheme, host, or port. An attacker controlling a service that a Tornado client contacts can respond with a redirect pointing to an attacker-controlled endpoint. The client then transmits Authorization, auth_username, auth_password, and auth_mode values to that endpoint.

The fix aligns SimpleAsyncHTTPClient behavior with CurlAsyncHTTPClient, which already stripped Authorization and Cookie headers on cross-origin redirects.

Root Cause

The redirect handler performed insufficient sanitization of the request object. Only the Host header was cleared, while HTTP Basic authentication parameters and the Authorization header persisted across origin boundaries. This violated the same-origin credential handling expected by RFC 7235.

Attack Vector

Exploitation requires the victim application to make an outbound HTTP request with credentials to an endpoint an attacker can influence. The attacker returns a 301, 302, 307, or 308 response with a Location header pointing to attacker-controlled infrastructure. The Tornado client automatically follows the redirect and includes the original credentials in the new request.

text

# Security fix note from docs/releases/v6.5.6.rst
Security fixes
~~~~~~~~~~~~~~

- ``SimpleAsyncHTTPClient`` now strips the ``Authorization`` and ``Cookie`` headers from the request
  when following a redirect to a different origin. This matches the default behavior of
  ``CurlAsyncHTTPClient``. Applications that need different behavior here can set
  ``follow_redirects=False`` and handle redirects manually.

Source: Tornado commit aba2569

Detection Methods for CVE-2026-49853

Indicators of Compromise

Outbound HTTP requests from Tornado-based services carrying Authorization headers to unexpected destination hosts
Access log entries showing 3xx redirect responses immediately followed by authenticated requests to different origins
Unusual DNS resolutions from application servers to unfamiliar external endpoints

Detection Strategies

Inventory Python environments and identify installations of Tornado prior to 6.5.6 using pip show tornado or SBOM scanning
Audit application code for use of SimpleAsyncHTTPClient or AsyncHTTPClient with auth_username, auth_password, or Authorization headers combined with follow_redirects=True
Inspect egress proxy logs for correlated redirect chains that cross origin boundaries while carrying authentication material

Monitoring Recommendations

Enable full HTTP header logging on outbound traffic proxies to capture cross-origin credential forwarding
Alert on redirects where the destination host differs from the original request host and authentication headers are present
Track dependency versions in CI/CD pipelines to flag Tornado versions below 6.5.6

How to Mitigate CVE-2026-49853

Immediate Actions Required

Upgrade Tornado to version 6.5.6 or later across all Python environments
Rotate any credentials that may have been transmitted through SimpleAsyncHTTPClient to third-party or untrusted endpoints
Review outbound HTTP client usage and disable follow_redirects where cross-origin redirects are not expected

Patch Information

The fix was merged in pull request #3626 and released in Tornado v6.5.6 on May 27, 2026. See the GitHub Security Advisory GHSA-3x9g-8vmp-wqvf for full details. The patch strips Authorization and Cookie headers when a redirect crosses origins, matching CurlAsyncHTTPClient behavior.

Workarounds

Set follow_redirects=False on HTTPRequest objects and handle redirect responses manually, explicitly clearing credentials before re-issuing requests
Switch to CurlAsyncHTTPClient which already strips authentication headers on cross-origin redirects
Restrict outbound network egress from Tornado applications to allowlisted destinations only

bash

# Upgrade Tornado to the patched version
pip install --upgrade 'tornado>=6.5.6'

# Verify installed version
python -c "import tornado; print(tornado.version)"