---
id: CVE-2026-49853
title: >-
  tornado: Tornado: Information disclosure via improper handling of credentials
  during HTTP redirects (CVE-2026-49853)
summary: >-
  A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect
  to a different origin, the client improperly retains and forwards sensitive
  authentication credentials, such as Authorization headers, to the new,
  potentially u…
severity: high
cvss: 7.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'
cvssSource: vendor
cwe:
  - CWE-201
  - CWE-200
vendor: Red Hat
product: Red Hat Enterprise Linux AppStream (v. 10)
affected:
  - enterprise_linux 10
  - enterprise_linux 9
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_9
patched:
  - enterprise_linux_appstream_v_10
  - enterprise_linux_appstream_v_9
published: '2026-07-14'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T15:23:50+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49853.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49853.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-49853'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2500672'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-49853'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-49853'
  - url: >-
      https://github.com/tornadoweb/tornado/commit/aba2569f7ed7a6bdbef816658fb6b7182531b751
  - url: 'https://github.com/tornadoweb/tornado/pull/3626'
  - url: 'https://github.com/tornadoweb/tornado/releases/tag/v6.5.6'
  - url: >-
      https://github.com/tornadoweb/tornado/security/advisories/GHSA-3x9g-8vmp-wqvf
  - url: 'https://access.redhat.com/errata/RHSA-2026:67147'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67146'
  - url: 'https://github.com/tornadoweb/tornado'
  - url: 'https://github.com/advisories/GHSA-3x9g-8vmp-wqvf'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
  - ghsa
epss: 0.00452
epssPercentile: 0.36681
aliases:
  - GHSA-3x9g-8vmp-wqvf
  - PYSEC-2026-3387
ecosystem: pip
ingestedAt: '2026-07-07T15:41:58.656Z'
---

## Overview

A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote attacker to gain unauthorized access to a user's credentials, leading to information disclosure.

## Vendor advisories

- **RHSA-2026:67147** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67147)
- **RHSA-2026:67146** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-09-14 · [advisory](https://access.redhat.com/errata/RHSA-2026:67146)
- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-25 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49853.json)

**tornado: Tornado: Information disclosure via improper handling of credentials during HTTP redirects** — rated Important by Red Hat. Released 2026-07-14, updated 2026-09-25.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9

Fixed:

- Red Hat Enterprise Linux AppStream (v. 10)
- Red Hat Enterprise Linux AppStream (v. 9)

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 9

Not affected:

- Exploit Intelligence
- Lightspeed Core
- Migration Toolkit for Applications 8
- OpenShift Lightspeed
- Red Hat Ansible Automation Platform 2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift Container Platform 4
- Red Hat OpenStack Platform 16.2

## Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67147
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258 https://access.redhat.com/errata/RHSA-2026:67146

Workarounds / mitigations:

- Applications utilizing Tornado's SimpleAsyncHTTPClient can mitigate this issue by explicitly disabling automatic redirection following. This can be achieved by setting `follow_redirects=False` when making HTTP requests. Manually handling redirects allows applications to ensure sensitive headers are not inadvertently sent to unintended origins. Disabling automatic redirects may alter application behavior that relies on this feature.

## Package advisory (CVE-2026-49853)

Affected packages:

- `tornado < 6.5.6`

Patched in:

- `tornado 6.5.6`

Source: https://osv.dev/vulnerability/GHSA-3x9g-8vmp-wqvf