Executive brief
Tornado is a popular Python web framework used to build web applications and APIs. The framework's set_cookie function contains an incomplete security fix that allows attackers to inject malicious cookie attributes by using capitalized parameter names. An attacker could exploit this to modify cookie security settings—such as forcing cookies to be transmitted over unencrypted connections or changing the cookie's domain—potentially leading to session hijacking or credential theft.
Technical details
This vulnerability is a bypass of CVE-2026-35536's incomplete patch. The original fix added validation to reject characters [\x00-\x20\x3b\x7f] in the hardcoded lowercase parameter names (name, domain, path, samesite), but the deprecated **kwargs code path bypasses this validation. Because Morsel.__setitem__ is case-insensitive, capitalized kwargs like Domain=, Path=, or SameSite= route to the same reserved attributes without character validation, allowing semicolon-delimited injection (e.g., Domain="evil.com; Secure; SameSite=None"). The vulnerability is network-reachable and requires no authentication or user interaction—only that an application uses capitalized keyword arguments to set_cookie. The fix involves applying the same character validation to all **kwargs entries.
Affected products
- Tornado Tornado 6.5.5 through before 6.5.8
Timeline
- 2026-08-07: disclosed: GitHub Security Advisory GHSA-wwv5-g3v4-889x published
- 2026-09-15: advisory: CVE-2026-91991 assigned