Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.2
CVE-2026-91992: Tornado before 6.5.7 may expose credentials via reused handles
CVE-2026-91992 · published 1 month ago
Summary
The Tornado web framework versions earlier than 6.5.7 can keep authentication details, such as TLS certificates or proxy passwords, when the same client object is used for multiple requests. This can let a malicious user see those credentials if they can send their own requests through the same client. Update Tornado to version 6.5.7 or later, or configure your code to create a new client for each separate request.
What to do
- Update tornadoweb tornado to version 6.5.7 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | tornadoweb | tornado | < 6.5.7 |
| Debian:12 | debian | python-tornado | All versions |
Original advisory text
Tornado before 6.5.7 Credential Leak via Handle Reuse
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
8.2
High
Type
CWE-200Information Exposure
Timeline
Published15 Sep 2026
Updated4 Nov 2026
First seen15 Sep 2026
Track software like this
Free during beta