CVE-2026-91991: Tornadoweb Tornado

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes by passing capitalized or legacy keyword arguments to set_cookie. Attackers can embed semicolon-delimited data in capitalized parameters like Domain, Path, or SameSite to bypass validation and modify cookie security attributes.

Affected products

• Tornadoweb Tornado: from 6.5.5, before 6.5.8 (fixed in 6.5.8)

Published 2026-09-15. Last modified 2026-10-08.