CVE-2026-91992: Tornado CurlAsyncHTTPClient Credential Leak

CVE-2026-91992 is an information disclosure vulnerability in Tornado before version 6.5.7 where CurlAsyncHTTPClient reuses handles without clearing state, allowing credential leakage across requests. This article covers technical details, affected versions, security impact, and mitigation strategies.

CVE-2026-91992 Overview

CVE-2026-91992 is an information disclosure vulnerability [CWE-200] in the Tornado web framework affecting versions prior to 6.5.7. The flaw resides in CurlAsyncHTTPClient, where pycurl handles are reused across requests without proper state clearing. TLS client certificates and proxy authentication credentials configured for one request can persist and leak into subsequent unrelated requests issued through the same client instance. Attackers who can trigger requests through a shared client can capture sensitive credentials sent to unintended endpoints.

Critical Impact
Sensitive TLS certificates and proxy authentication credentials can leak to unintended destinations when applications reuse a single CurlAsyncHTTPClient instance across requests with different security contexts.

Affected Products

Tornado web framework versions prior to 6.5.7
Python applications using tornado.curl_httpclient.CurlAsyncHTTPClient
Deployments relying on pycurl as the Tornado HTTP client backend

Discovery Timeline

2026-09-15 - CVE-2026-91992 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91992

Vulnerability Analysis

Tornado's CurlAsyncHTTPClient maintains a pool of pycurl easy handles to avoid the overhead of allocating a new libcurl handle for every request. When a handle is returned to the pool and later reused, request-specific options set through pycurl.setopt remain configured on the underlying handle. Tornado does not reset all sensitive options before dispatching the next request.

Affected options include TLS client certificate paths, private keys, and proxy authentication credentials such as CURLOPT_PROXYUSERPWD. A request that does not explicitly set these options inherits the values from a prior request that did. The result is that credentials scoped to one destination can be transmitted to a completely different host during a subsequent request.

The issue is classified as an information exposure weakness and is exploitable over the network when an attacker can influence request targets or observe outbound traffic from the vulnerable client.

Root Cause

The root cause is incomplete state reset between requests that share a pooled pycurl handle. libcurl retains previously set options until explicitly cleared or reset with curl_easy_reset. Tornado's handle recycling logic did not clear TLS and proxy authentication state, violating the isolation expected between independent HTTP requests issued from the same client.

Attack Vector

Exploitation requires an application that reuses a single CurlAsyncHTTPClient instance to issue requests with differing security contexts, for example both authenticated proxy requests and requests to attacker-influenced URLs. An attacker who controls one request destination can receive credentials or client certificates originally intended for another target. The attack complexity is high because it depends on request ordering, handle pool state, and the application's client usage pattern.

The vulnerability is documented in the GitHub Security Advisory GHSA-pw6j-qg29-8w7f and the VulnCheck Advisory: Tornado Credential Leak.

Detection Methods for CVE-2026-91992

Indicators of Compromise

Outbound HTTPS connections presenting client certificates to hosts that should not receive them.
Proxy Proxy-Authorization headers observed in traffic to non-proxy destinations.
Application logs showing unexpected 407 or 401 responses from third-party services following legitimate proxy-authenticated requests.

Detection Strategies

Inventory Python dependencies and flag tornado installations older than 6.5.7 via software composition analysis.
Instrument outbound HTTP client code to log the destination host alongside any TLS client certificate or proxy credential presented.
Correlate egress TLS metadata with expected credential-to-destination mappings to surface mismatches.

Monitoring Recommendations

Monitor egress network traffic for TLS handshakes that include client certificates directed at unauthorized endpoints.
Alert on unexpected use of proxy authentication headers in application traffic.
Track dependency updates in CI/CD pipelines to ensure vulnerable Tornado versions are not reintroduced.

How to Mitigate CVE-2026-91992

Immediate Actions Required

Upgrade Tornado to version 6.5.7 or later in all production and development environments.
Audit application code for shared CurlAsyncHTTPClient instances handling requests with different credentials or destinations.
Rotate any TLS client certificates or proxy credentials that may have been exposed through vulnerable deployments.

Patch Information

The Tornado maintainers addressed the issue in version 6.5.7. The fix ensures that pooled pycurl handles have sensitive request options cleared before reuse. Refer to the GitHub Security Advisory GHSA-pw6j-qg29-8w7f for full remediation details and version constraints.

Workarounds

Switch the HTTP client backend from CurlAsyncHTTPClient to SimpleAsyncHTTPClient where feasible until the upgrade is applied.
Instantiate a separate CurlAsyncHTTPClient per security context so credentials cannot cross between unrelated requests.
Explicitly set or reset all sensitive pycurl options such as CURLOPT_SSLCERT, CURLOPT_SSLKEY, and CURLOPT_PROXYUSERPWD on every request to overwrite lingering state.

bash

# Configuration example
pip install --upgrade 'tornado>=6.5.7'
pip show tornado | grep -i version