Skip to main content

Tornado EUVDEUVD-2026-78664

| CVE-2026-91992 HIGH
Information Exposure (CWE-200)
2026-09-15 VulnCheck GHSA-jqv5-7x9v-7j83
Information Disclosure Red Hat Suse Tornado Tornadoweb
8.2
CVSS 4.0 · Vendor: VulnCheck
View

Vulnerability Assessment

Weakness
CWE
CWE-200
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK

2 techniques across 2 tactics: Collection, Discovery

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 15, 2026

Credential leakage in Tornado's CurlAsyncHTTPClient (all releases through 6.5.6) lets sensitive per-request state — client TLS certificates (SSLCERT/SSLKEY) and proxy basic-auth credentials (PROXYUSERPWD) — persist on pooled pycurl handles and be presented to a different, unintended host on a later request. The flaw affects applications that pass per-request credentials to the curl-backed client and reuse the same client instance across hosts; it is not reachable by an anonymous internet attacker against a default server deployment, and the vendor rates attack complexity as high with attack requirements present. No public exploit code has been identified at time of analysis and no active exploitation is reported; the vendor has fixed the issue in Tornado 6.5.7.

Affected VersionsENISA

Tornado 0 <6.5.7

Affected Packages

pypi tornado fix: 6.5.7

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in pypi

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check

Know when Tornado gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.2 HIGH
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE 7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Red Hat 5.9 MEDIUM

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector
Network
Attack Complexity
High
Attack Requirements
Present
Privileges Required
None
User Interaction
None
Vulnerable system: Confidentiality
High
Vulnerable system: Integrity
None
Vulnerable system: Availability
None
Subsequent system: Confidentiality
None
Subsequent system: Integrity
None
Subsequent system: Availability
None

Lifecycle Timeline

2
Patch available
Sep 15, 2026 - 16:03 EUVD
CVE Published
Sep 15, 2026 - 15:18 cve.org
HIGH 8.2

DescriptionCVE.org

Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 10 pypi packages depend on tornado (8 direct, 2 indirect)

Ecosystem-wide dependent count for version 6.5.7.

Technical POC Analysis

Credential leak by resource reuse after release: CWE-200 (exposure of sensitive information), with the advisory also proposing CWE-672 (operation on a resource after release).

Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.

Sign in to read

Threat Intelligence Overview

EPSS Score
0.2%
Top 89% exploitable
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS Vendor GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact· derived
Medium

Priority Score

41
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +41
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Tornado

View all
CVE-2024-42733 CRITICAL POC
9.8 Mar 07

An issue in Docmosis Tornado v.2.9.7 and before allows a remote attacker to execute arbitrary code via a crafted script

CVE-2023-25266 HIGH POC
8.8 Feb 28

An issue was discovered in Docmosis Tornado prior to version 2.9.5. Rated high severity (CVSS 8.8), this vulnerability i
CVE-2025-67726 HIGH POC
7.5

py3-tornado in Alpine Linux received a security fix packaged as version 6.5.4-r0, addressing an unspecified vulnerabilit
CVE-2023-25265 HIGH POC
7.5 Feb 28

Docmosis Tornado <= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the fil
CVE-2023-25264 HIGH POC
7.5 Feb 28

An issue was discovered in Docmosis Tornado prior to version 2.9.5. Rated high severity (CVSS 7.5), this vulnerability i
CVE-2026-116577 MEDIUM POC
5.3 Oct 26

Tornado's HTTP/1.x header parser consumes quadratic CPU time when a header value is spread across many obsolete line-fol
CVE-2026-103262 HIGH
8.7 Oct 01

Denial of service in the Tornado web framework's CurlAsyncHTTPClient (all releases before 6.5.9) lets an unauthenticated
CVE-2026-31958 HIGH
8.7 Mar 11

In versions of Tornado prior to 6.5.5, the only limit on the number of parts in `multipart/form-data` is the `max_body_s
CVE-2026-91990 HIGH
8.7 Sep 15

Memory amplification denial of service in the Tornado Python web framework before 6.5.8 lets unauthenticated remote atta
CVE-2026-103263 HIGH
8.2 Oct 01

Unauthenticated local file disclosure in Tornado before 6.5.9 lets remote attackers read files outside a configured stat
CVE-2026-82397 HIGH
7.5 Aug 31

Denial-of-service in Tornado prior to 6.5.8 allows unauthenticated remote attackers to stall the entire server by sendin
CVE-2025-67725 HIGH
7.5

Tornado Python web framework on Alpine Linux received a security fix in package version 6.5.4-r0, addressing an uncharac

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2021-41277 HIGH POC
7.5
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise Micro 5.3 Affected
SUSE Linux Enterprise Micro 5.4 Affected

References

Advisories & patches
ADVISORY https://github.com/tornadoweb/tornado/security/advisories/GHSA-pw6j-qg29-8w7f ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-91992 ADVISORY https://ubuntu.com/security/notices/USN-8952-1 REF https://www.vulncheck.com/advisories/tornado-before-6.5.7-credential-leak-via-handle-reuse

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy