Tornado CVE-2026-116578

The application must use tornado.web.RedirectHandler with a URL template where a regex capture-group substitution can influence the scheme or host - specifically a substitution at the start of the path (e.g. {"url": "/{0}/destination"}), directly after a fixed host (e.g. {"url": "https://new.example.com{0}"}), or at the very start of the template (e.g. "{0}"); protocol-relative, absolute, backslash, percent-encoded, host-extension, and user-info variants all qualify. Applications are NOT affected if templates are static or if every substitution follows a fixed host and a slash (e.g. "/static/{0}" or "https://example.com/{0}"). Exploitation further requires victim user interaction (clicking the crafted link), so it is config-dependent and not exploitable against default or unaffected routing configurations, and yields only phishing-grade redirection, not code execution or data access.

This is a genuinely low-priority issue, and the signals agree. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:A) scores only 2.1, with impact limited to SI:L and no confidentiality, availability, or vulnerable-system integrity impact - consistent with an open redirect (CWE-601) used for phishing rather than direct compromise. EPSS is 0.46% (40th percentile), there is no CISA KEV listing, and the vuln.today decision label is 'monitor', so no signal points to urgency. The key limiting factor is not in the raw CVSS: exploitation requires the application to have deployed RedirectHandler with a specifically vulnerable template, so this is config-dependent and will not affect every Tornado deployment. No public exploit tool is provided in the input (the references are the vendor advisory, PR, and patch commits), though the advisory and patch tests document the exact triggering request paths. There are no contradictions between the signals; all consistently indicate a low-severity, defense-in-depth fix rather than an emergency.

An attacker crafts a link to the victim application whose path contains an attacker host (e.g. a protocol-relative or absolute URL) that is substituted into a vulnerable RedirectHandler template, then delivers it to a victim in a phishing email or message. When the victim clicks the trusted-looking link on the application's own domain, their browser is transparently redirected to the attacker-controlled site, lending credibility to a credential-harvesting or malware page. No standalone exploit tool is published, but the advisory and patch test cases spell out concrete triggering paths such as /moved.evil.com/x and /any/https://evil.com/.