Live › vulnerability › CVE-2026-116748
Go to dashboardTransmission 4.0.0 before 4.1.3 returns its X-Transmission-Session-Id anti-CSRF token to any web origin via permissive CORS in rpc-server.cc. A malicious web page can read that token and replay it to run RPC calls, such as executing script-torrent-done hooks, changing the download directory, or deleting torrents and data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 22:25 UTC. All times on this page are UTC.
Teams that run Transmission 4.0.0 through 4.1.2 with the RPC web interface reachable from a browser the attacker can lure a user to, such as a desktop or home-server daemon on a network where users browse the web. Installs on a locked-down host with no browser access to the RPC port and no logged-in users browsing the web on that machine are less exposed. Unknown how the sources scope the default configuration.
No product ranges from the sources yet.
transmission-daemon --version or transmission-remote --version and check whether it is below 4.1.3rpc-port (default 9091) in settings.jsonrpc-whitelist-enabled and rpc-authentication-required are set in settings.json4.1.3 or laterrpc-authentication-required and restrict access with rpc-whitelist or a firewallEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
This page as .md · .json · in your agent: get_signal("CVE-2026-116748")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.