CVE-2026-49853
Description
A flaw was found in Tornado's SimpleAsyncHTTPClient. When following a redirect to a different origin, the client improperly retains and forwards sensitive authentication credentials, such as Authorization headers, to the new, potentially untrusted, destination. This vulnerability allows a remote attacker to gain unauthorized access to a user's credentials, leading to information disclosure.
Statement
This is an information disclosure flaw in the Tornado SimpleAsyncHTTPClient where sensitive authentication credentials can be inadvertently exposed. When an application using SimpleAsyncHTTPClient follows a 3xx redirect to a different origin (scheme, host, or port), Authorization and other authentication headers are not cleared, potentially leaking them to an untrusted destination. This could lead to unauthorized access to resources.
Mitigation
Applications utilizing Tornado's SimpleAsyncHTTPClient can mitigate this issue by explicitly disabling automatic redirection following. This can be achieved by setting `follow_redirects=False` when making HTTP requests. Manually handling redirects allows applications to ensure sensitive headers are not inadvertently sent to unintended origins. Disabling automatic redirects may alter application behavior that relies on this feature.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.7 | N/A | 7.7 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
