Bug 2561132 (CVE-2026-116578)

Summary: CVE-2026-116578 tornado: tornado: Open redirect via crafted request paths in RedirectHandler URL templates
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, anpicker, aos-team-art-private, asdas, bbrownin, dpaolell, dschmidt, ebourniv, eglynn, hasun, jdelft, jfula, jjoyce, jlanda, jowilson, jpretori, jschluet, jupierce, jwong, kaycoth, kshier, lgarciaa, lhh, mbiarnes, mburns, mgarciac, nyancey, omaciel, ometelka, ppalepu, ppostler, prdhamdh, ptisnovs, rbobbitt, rhel-process-autobot, sbunciak, sghai, sidsharm, simaishi, stcannon, suppawar, syedriko, tguha, vlaad, watson-tool-maintainers, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Tornado. When an application configures RedirectHandler with dynamic URL templates, user-controlled input in request paths can alter the target redirect scheme or host location. A remote attacker can exploit this vulnerability by sending a crafted request to trigger an open redirect, redirecting users to an arbitrary external website. This flaw can be leveraged in phishing attacks to trick users into visiting malicious destinations while appearing to interact with a trusted domain.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-26 21:02:51 UTC 
Tornado is a Python web framework and asynchronous networking library. Prior to 6.6, tornado.web.RedirectHandler URL templates can place regex-capture substitutions where crafted request paths change the redirect scheme or network location. Affected placements include substitutions at the start of a path, directly after a fixed host, or at the beginning of the template, including protocol-relative, absolute, backslash, encoded, host-extension, and user-info variants interpreted by browsers as attacker-controlled destinations. Static templates and substitutions after a fixed host followed by a slash are not affected. An attacker can use the resulting open redirect on the application's domain for phishing. This issue is fixed in version 6.6.