CVE-2026-91991
Received Received - Intake

Tornado Cookie Attribute Injection via set_cookie

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91991
EUVD
EUVD-2026-78663

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
tornadoweb tornado to 6.5.8 (exc)
tornadoweb tornado From 6.5.5 (inc) to 6.5.7 (inc)
apache tornado to 6.5.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Tornado before 6.5.8 has an incomplete fix for cookie attribute injection. Attackers can bypass validation by using capitalized or legacy keyword arguments in the set_cookie method. This allows them to inject semicolon-delimited data into cookie attributes like Domain, Path, or SameSite, modifying security flags such as Secure, HttpOnly, or SameSite.

Detection Guidance

To detect this vulnerability, inspect your Tornado application's use of the set_cookie method. Check for any usage of capitalized or legacy keyword arguments like Domain, Path, or SameSite. Review logs for unusual cookie attributes or semicolon-delimited data in cookie values.

Impact Analysis

This vulnerability allows attackers to manipulate cookie attributes, potentially bypassing security measures like Secure, HttpOnly, or SameSite flags. This could lead to session hijacking, cross-site scripting (XSS), or unauthorized access to sensitive data if exploited.

Mitigation Strategies

Immediately upgrade Tornado to version 6.5.8 or later. If upgrading is not possible, apply input validation to all cookie attributes in the set_cookie method, including capitalized kwargs. Remove or restrict the deprecated **kwargs path in set_cookie to prevent bypassing validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91991. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart