{"id":"CVE-2026-49853","title":"tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects (CVE-2026-49853)","summary":"A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially u…","severity":"high","cvss":7.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N","cvssSource":"vendor","cwe":["CWE-201","CWE-200"],"vendor":"Red Hat","product":"Red Hat Enterprise Linux AppStream (v. 10)","affected":["migration_toolkit_for_applications 8","enterprise_linux 10","enterprise_linux 9","openstack_platform 16.2","enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9"],"published":"2026-07-14","updated":"2026-09-14","sourceUpdated":"2026-09-14T06:18:29+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49853.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49853.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-49853"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2500672"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-49853"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-49853"},{"url":"https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751"},{"url":"https://github.com/tornadoweb/tornado/pull/3626"},{"url":"https://github.com/tornadoweb/tornado/releases/tag/v6.5.6"},{"url":"https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf"},{"url":"https://access.redhat.com/errata/RHSA-2026:67147"},{"url":"https://access.redhat.com/errata/RHSA-2026:67146"},{"url":"https://github.com/tornadoweb/tornado"},{"url":"https://github.com/advisories/GHSA-3x9g-8vmp-wqvf"}],"tags":["csaf","vex","red-hat","osv","pip","ghsa"],"epss":0.00445,"epssPercentile":0.38011,"aliases":["GHSA-3x9g-8vmp-wqvf","PYSEC-2026-3387"],"ecosystem":"pip","ingestedAt":"2026-07-07T15:41:58.656Z","slug":"CVE-2026-49853","body":"## Overview\n\nA flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote attacker to gain unauthorized access to a user's credentials, leading to information disclosure.\n\n## Vendor advisories\n\n- **RHSA-2026:67147** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67147)\n- **RHSA-2026:67146** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67146)\n- **Red Hat VEX** · Important · affected: Migration Toolkit for Applications 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenStack Platform 16.2 · no fix planned: Migration Toolkit for Applications 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenStack Platform 16.2 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49853.json)\n\n**tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects** — rated Important by Red Hat. Released 2026-07-14, updated 2026-09-14.\n\nAffected:\n\n- Migration Toolkit for Applications 8\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenStack Platform 16.2\n\nFixed:\n\n- Red Hat Enterprise Linux AppStream (v. 10)\n- Red Hat Enterprise Linux AppStream (v. 9)\n\nNo fix planned:\n\n- Migration Toolkit for Applications 8\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 9\n- Red Hat OpenStack Platform 16.2\n\nNot affected:\n\n- Exploit Intelligence\n- Lightspeed Core\n- OpenShift Lightspeed\n- Red Hat Ansible Automation Platform 2\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux AI (RHEL AI) 3\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67147\nFor details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67146\n\nWorkarounds / mitigations:\n\n- Applications utilizing Tornado's SimpleAsyncHTTPClient can mitigate this issue by explicitly disabling automatic redirection following. This can be achieved by setting `follow_redirects=False` when making HTTP requests. Manually handling redirects allows applications to ensure sensitive headers are not inadvertently sent to unintended origins. Disabling automatic redirects may alter application behavior that relies on this feature.\n\n## Package advisory (CVE-2026-49853)\n\nAffected packages:\n\n- `tornado < 6.5.6`\n\nPatched in:\n\n- `tornado 6.5.6`\n\nSource: https://osv.dev/vulnerability/GHSA-3x9g-8vmp-wqvf","depth":"twilight","depthScore":42,"depthScoreParts":{"impact":42.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}