Vulnerability · Published Oct 26, 2026 · Assigned by VulnCheck

CVE-2026-116748Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

High 8.8

In plain English

A high-severity security flaw in transmission from transmission. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 69% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)1.2%top 30.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	transmission	no fix listed	DEBIAN-CVE-2026-116748
Debian:13	transmission	no fix listed	DEBIAN-CVE-2026-116748
Debian:14	transmission	4.1.3+dfsg-1	DEBIAN-CVE-2026-116748
Ubuntu:22.04:LTS	transmission	no fix listed	UBUNTU-CVE-2026-116748
Ubuntu:24.04:LTS	transmission	no fix listed	UBUNTU-CVE-2026-116748
Ubuntu:26.04:LTS	transmission	no fix listed	UBUNTU-CVE-2026-116748
Ubuntu:26.10	transmission	no fix listed	UBUNTU-CVE-2026-116748

Affected products (as reported)

Vendor	Product	Versions
transmission	transmission	4.0.0 – before 4.1.3

Weakness: CWE-942 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

Pull Request #8938 issue-tracking, patch
Patch Commit patch
https://github.com/transmission/transmission product
transmission 4.1.3 Release Notes release-notes
https://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560 technical-description
https://joshua.hu/transmission-cors-rpc-csrf-rce-drive-by-exploit third-party-advisory
VulnCheck Advisory: Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token third-party-advisory