Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-116748: Transmission up to 4.1.2 exposes session token to any website

CVE-2026-116748 · published 2 days ago

Summary

Versions of Transmission from 4.0.0 through 4.1.2 leak the anti‑CSRF session token to any web page that contacts the program. A malicious site could read the token and then tell Transmission to start, stop, move or delete torrents. Upgrade to Transmission 4.1.3 or later, or block cross‑origin requests to the RPC interface, to stop this risk.

What to do

Update debian transmission to version 4.1.3+dfsg-1.
Update transmission transmission to version 4.1.3 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
Debian:12	debian	transmission	All versions
Debian:14	debian	transmission	< 4.1.3+dfsg-1 Fix: upgrade to 4.1.3+dfsg-1
–	transmission	transmission	< 4.1.3
Ubuntu:16.04:LTS	canonical	transmission	All versions

Original advisory text

Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.

References

https://ubuntu.com/security/CVE-2026-116748 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-116748 Third Party Advisory
https://github.com/cveproject/cvelistv5/tree/main/cves/2026/116xxx/cve-2026-1167... Third Party Advisory
https://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-serv... Third Party Advisory
https://nvd.nist.gov/vuln/detail/cve-2026-116748 Third Party Advisory
https://security-tracker.debian.org/tracker/CVE-2026-116748 Vendor Advisory
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/116xxx/CVE-2026-1167... Vendor Advisory
https://github.com/transmission/transmission/releases/tag/4.1.3 Vendor Advisory
https://joshua.hu/transmission-cors-rpc-csrf-rce-drive-by-exploit Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-116748 Vendor Advisory
https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f... Patch
https://github.com/transmission/transmission/pull/8938 Patch
https://github.com/transmission/transmission Product
https://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-serv... Third Party Advisory
https://www.vulncheck.com/advisories/transmission-4.0.0-before-4.1.3-permissive-... Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.9 Critical

Exploitation

<1% chance of attack within 30 days

Type

CWE-942Permissive Cross-domain Security Policy with Untrusted Domains

Timeline

Published26 Oct 2026

Updated29 Oct 2026

First seen26 Oct 2026

Sources

CVE-2026-116748 · NVD

CVE-2026-116748 · MITRE

CVE-2026-116748 · OSV

UBUNTU-CVE-2026-116748 · OSV

DEBIAN-CVE-2026-116748 · OSV

Track software like this

Free during beta