CVE-2026-91992 Tornado before 6.5.7 Credential Leak via Handle Reuse
Attackers can leak sensitive credentials like TLS certificates or proxy auth via handle reuse in Tornado's CurlAsyncHTTPClient.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-91992?
CVE-2026-91992 is a high-severity vulnerability in tornadoweb tornado, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Tornado before 6.5.7 contains a credential leak vulnerability in CurlAsyncHTTPClient where pycurl handles are reused across requests without proper state clearing. Attackers can obtain sensitive credentials by issuing requests through the same client instance, allowing TLS certificates or proxy authentication to persist across unintended requests.
Weakness: CWE-200
Which versions are affected by CVE-2026-91992?
2 open source packages ship an affected version, including tornado.
| Package | Affected | Fixed in |
|---|---|---|
tornado PyPI | All versions | 6.5.7 |
tornado PyPI | All versions | 6.5.7 |
How do I fix CVE-2026-91992?
Upgrade tornado to 6.5.7 or later.
Is CVE-2026-91992 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-91992 exists.
Sources
Also known as AZL-103098, BELL-CVE-2026-91992, CLEANSTART-2026-QY66833, DEBIAN-CVE-2026-91992, ECHO-fb4d-7ed6-e752, GHSA-jqv5-7x9v-7j83 and 13 more.