CVE-2026-49853

Deferred Deferred - Pending Action

Tornado Framework Authorization Header Leak in Redirects

Publication date: 2026-07-14

Last updated on: 2026-07-21

Assigner: GitHub, Inc.

Description

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.6, SimpleAsyncHTTPClient shallow-copied redirected requests and removed only the Host header, leaving Authorization, auth_username, auth_password, and auth_mode in place when a redirect changed scheme, host, or port. This issue is fixed in version 6.5.6.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-14

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-07-15

EPSS Evaluated

2026-08-02

NVD

CVE-2026-49853

Affected Vendors & Products

Vendor	Product	Version / Range
twisted	tornado	to 6.5.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

Tornado before 6.5.6 had a flaw in SimpleAsyncHTTPClient where redirected requests were shallow-copied but only the Host header was removed. This left sensitive authentication details like Authorization, auth_username, auth_password, and auth_mode intact even when a redirect changed the scheme, host, or port.

Detection Guidance

This vulnerability can be detected by checking the version of Tornado installed on your system. Run 'pip show tornado' or 'pip list | grep tornado' to verify if the version is below 6.5.6. Additionally, inspect your application code for usage of SimpleAsyncHTTPClient and review HTTP redirect handling logic.

Impact Analysis

An attacker could exploit this to capture or misuse authentication credentials during redirects, potentially gaining unauthorized access to protected resources or user data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA, potentially resulting in legal penalties and loss of trust.

Mitigation Strategies

Upgrade Tornado to version 6.5.6 or later immediately. If upgrading is not possible, review and modify any code using SimpleAsyncHTTPClient to ensure sensitive headers like Authorization are properly cleared during redirects.

Hi! I’m here to help you understand CVE-2026-49853. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70