CVE-2026-49853

Summary

CVE-2026-49853 is a credential-exposure flaw in Tornado (pip, < 6.5.6). When SimpleAsyncHTTPClient followed an HTTP redirect, it did not strip the Authorization and Cookie headers even when the redirect target was a different origin — forwarding the caller's credentials to that new host.

Technical Detail

Sensitive request headers are scoped to the origin they were issued for. A correct HTTP client drops Authorization and Cookie when a redirect crosses to a different scheme, host, or port. Tornado's client carried them through unchanged:

• A request to a trusted endpoint includes an Authorization bearer token or session Cookie.
• The endpoint (or an attacker who can influence it) returns a redirect to a different origin.
• The client re-issues the request to the new origin with the original credentials attached.

The attacker-controlled destination now receives a valid token it was never meant to see.

Impact

Exposure of bearer tokens and session cookies to unintended third-party hosts. Any code path that lets an attacker influence a redirect target — open redirects, compromised upstreams, SSRF-adjacent flows — becomes a credential-exfiltration channel.

Resolution

Upgrade to Tornado 6.5.6, which clears Authorization and Cookie headers on cross-origin redirects. Hardening guidance:

• Where possible, disable automatic redirect-following for requests that carry credentials, and validate redirect targets explicitly.
• Prefer narrowly-scoped, short-lived tokens so a leaked credential has limited blast radius.

References

Disclosure

Reported to the Tornado maintainers by SnailSploit together with noobone123, 0xHunSec, and sondt99; credit accepted. Coordinated via GitHub Security Advisory GHSA-3x9g-8vmp-wqvf. See the advisory for affected and fixed version details.