CVE-2026-91992
Received Received - Intake

Tornado 6.5.7 Credential Leak via CurlAsyncHTTPClient

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91992
EUVD
EUVD-2026-78664

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
tornadoweb tornado to 6.5.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Tornado before 6.5.7 has a credential leak issue in CurlAsyncHTTPClient where pycurl handles are reused without clearing state. This allows attackers to access sensitive credentials like TLS certificates or proxy auth by sending requests through the same client instance.

Detection Guidance

To detect this vulnerability, inspect applications using Tornado's CurlAsyncHTTPClient for improper handling of pycurl resources. Check for reused client instances across requests without clearing state. Review logs for unexpected credential exposure or persistent TLS/proxy auth across unrelated requests.

Impact Analysis

Attackers could steal credentials such as TLS certificates or proxy authentication details, potentially leading to unauthorized access to systems or data. This could result in data breaches or further exploitation of affected services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations may face compliance violations, legal penalties, and reputational damage due to potential data exposure.

Mitigation Strategies

Upgrade Tornado to version 6.5.7 or later. Ensure each request uses a fresh CurlAsyncHTTPClient instance or properly clears pycurl state after use. Avoid reusing client instances for multiple unrelated requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91992. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart