Skip to content
High-Risk CORS Vulnerability in Transmission Torrent Client Exposed

High-Risk CORS Vulnerability in Transmission Torrent Client Exposed

First seen 27 Oct 2026, 02:13 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 27, 2026 at 07:12 UTC
  • •CVE-2026-116748 allows unauthorized RPC access via CORS vulnerability.
  • •Affected versions include Transmission 4.0.0 to 4.1.2; upgrade to 4.1.3 is critical.
  • •High risk for self-hosted torrent clients with accessible RPC interfaces.

A permissive CORS vulnerability (CVE-2026-116748) was discovered in Transmission versions 4.0.0 to 4.1.2, allowing malicious websites to access the X-Transmission-Session-Id anti-CSRF token. This vulnerability enables attackers to issue RPC commands without user authentication, potentially altering download directories, deleting torrents, or executing arbitrary scripts. The flaw affects self-hosted instances of Transmission, particularly on NAS devices and internet-facing servers. Users are urged to upgrade to version 4.1.3 or later to mitigate risks. The vulnerability was published on October 26, 2026, with a CVSS score of 8.7, indicating high severity. Immediate action is recommended for those with exposed RPC interfaces.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-26
CVE-2026-116748 published
Transmission vulnerability disclosed, allowing RPC access via CORS flaw in versions 4.0.0 to 4.1.2.
Redpacketsecurity
2026-10-27
Public awareness raised
Security articles highlight the vulnerability's risks and recommend immediate upgrades.
joshua.hu

More articles in this cluster (6)

Following this threat?

Track CVE-2026-116748 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 3

Common questions

Which versions are affected?
Transmission versions 4.0.0 to 4.1.2 are affected by this vulnerability.
What should I do if I use Transmission?
Upgrade to Transmission version 4.1.3 or later to mitigate the vulnerability.
Is there any active exploitation reported?
No active exploitation has been confirmed, but the vulnerability poses a significant risk.