CVE Alert: CVE-2026-116748 – transmission

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.

**Risk verdict:** High risk where the RPC interface is reachable from a user’s browser; urgency cannot be raised further without KEV, SSVC, EPSS or PoC status.

**Why this matters:** A malicious site may abuse a browser visit to obtain RPC access without first compromising the user’s account. An attacker could then change client settings, manipulate downloads, delete torrents or data, and potentially trigger configured completion actions. The main impact is on the host running the client and the data it can access.

**Most likely attack path:** The service is network-reachable, with no RPC credentials required by the stated attack metrics and low attack complexity. User interaction is needed: typically, a user must visit an attacker-controlled page while the vulnerable client’s RPC endpoint is accessible to their browser. Scope is unchanged, so direct lateral movement is not indicated, though exposed files or scripts could create further risk.

**Who is most exposed:** Prioritise self-hosted torrent clients with remotely reachable RPC interfaces, especially on NAS devices, servers, and internet-facing seedboxes.

Review RPC access logs for unexpected origins, sessions, or state-changing requests.

Check for unsolicited changes to download paths, torrent activity, or completion scripts.

Look for unusual deletions or downloads initiated by the client account.

Mitigation and prioritisation:

Upgrade to the fixed release; treat this as a high-priority patch for exposed instances.

Restrict RPC access to trusted hosts and networks; do not expose it directly to the internet.

Until patched, disable remote RPC access where operationally feasible.

Review configured completion scripts and limit the client account’s file-system permissions.

KEV, SSVC, EPSS and PoC indicators were not provided; obtain them to refine urgency.

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.