## Tornado: Open redirect in RedirectHandler via protocol-relative URLs

- 種別: advisory
- 重大度: low
- 関連技術: python
- CVE: CVE-2026-116578
- 公開日時: 2026-10-28T22:43:45.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-pw9p-v7r6-gx4p)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-pw9p-v7r6-gx4p

影響: pip:tornado < 6.6 → 6.6
tornado.web.RedirectHandler builds its target URL by substituting parts of the request path into a template. Depending on where those substitutions appear in the template, an attacker can craft a request that redirects to a host of their choosing. This creates an open redirect on the application's domain, which can be used in phishing. Impact Applications are affected if they use RedirectHandler with a URL template where a regex capture group can influence the scheme or host of the redirect. Th…