CVE-2026-91991 Tornado before 6.5.8 Cookie Attribute Injection via Capitalized kwargs
Attackers can inject arbitrary cookie attributes via capitalized kwargs in Tornado, bypassing security validation and modifying cookie settings.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-91991?
CVE-2026-91991 is a medium-severity vulnerability in tornadoweb tornado, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.
Weakness: CWE-113
Which versions are affected by CVE-2026-91991?
2 open source packages ship an affected version, including tornado.
| Package | Affected | Fixed in |
|---|---|---|
tornado PyPI | From 6.5.5 | 6.5.8 |
tornado PyPI | From 6.5.5 | 6.5.8 |
How do I fix CVE-2026-91991?
Upgrade tornado to 6.5.8 or later.
Is CVE-2026-91991 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-91991 exists.
Sources
Also known as BELL-CVE-2026-91991, CLEANSTART-2026-FR34222, CLEANSTART-2026-MS68027, CLEANSTART-2026-NF84390, CLEANSTART-2026-OZ84157, CLEANSTART-2026-RK84502 and 29 more.