CVE-2026-116748 in Transmission
Summary
by MITRE • 10/26/2026
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/26/2026
The vulnerability identified in Transmission versions prior to 4.1.3 represents a critical failure in cross-origin resource sharing policies within the application's remote procedure call server implementation. Specifically located in the handle_request function of rpc-server.cc, this flaw stems from an overly permissive configuration that fails to restrict access based on the Origin header sent by client applications. In standard web security practices, CORS mechanisms are designed to prevent malicious websites from reading sensitive data or performing actions on behalf of a user without explicit consent. However, in this instance, the server incorrectly responds to requests originating from any domain with headers that allow such cross-origin reads. This misconfiguration effectively neutralizes one of the primary defenses against cross-site request forgery attacks by exposing session identifiers and authentication tokens to unauthorized third-party scripts hosted on malicious web pages.
The technical core of this vulnerability lies in how the X-Transmission-Session-Id token is handled during the initial handshake process, which returns a 409 Conflict status code when a session needs to be established or renewed. Under normal secure operations, this response should include strict CORS headers that restrict access to only trusted origins, such as localhost if accessed via a local web interface. Instead, the vulnerable versions return responses with Access-Control-Allow-Origin set to allow all sources, often using an asterisk wildcard or reflecting the request origin without validation. This allows any webpage visited by a user who has Transmission running and authenticated in their browser background to execute JavaScript that reads this session token from the HTTP response headers. The attacker does not need to bypass traditional same-origin policies because the server explicitly permits cross-origin access, thereby facilitating data exfiltration of sensitive authentication material.
The operational impact of exploiting this vulnerability is severe due to the high privileges associated with the exposed RPC interface. Once an attacker obtains the X-Transmission-Session-Id token through a malicious webpage visited by the victim, they can replay this token in subsequent requests to interact directly with the Transmission daemon's API. This capability enables several destructive actions including the execution of arbitrary scripts upon torrent completion, modification of download directories to redirect files to unauthorized locations, and the deletion of specific torrents or their associated data files from disk. The ability to execute script-torrent-done commands is particularly dangerous as it allows for remote code execution on the host machine if malicious scripts are configured in the client settings. Furthermore, altering download directories can lead to privacy violations by exposing sensitive file paths or facilitating malware distribution through redirected downloads.
This vulnerability aligns with CWE-942, which describes Permissive Cross-domain Policy with Untrusted Domains, and falls under the MITRE ATT&CK technique of T1505.003 for Server Software Component: Web Shell, although in this context it is more accurately mapped to data exfiltration via cross-origin requests leading to unauthorized API access. The attack vector leverages social engineering by tricking users into visiting a malicious site while their browser holds an active session with the Transmission web interface. Since modern browsers enforce same-origin policies for reading responses from different origins, this vulnerability bypasses those protections entirely through server-side misconfiguration rather than client-side exploitation of parsing errors.
Mitigation strategies must focus on immediate patching and configuration hardening. Users should upgrade to Transmission version 4.1.3 or later where the CORS handling in rpc-server.cc has been corrected to enforce strict origin validation. For environments where upgrading is not immediately feasible, administrators can mitigate risk by disabling the web interface entirely if it is not required for operation. Alternatively, restricting access to the RPC port via firewall rules so that only trusted local networks or specific IP addresses can reach the service will prevent remote attackers from initiating the handshake process. Additionally, ensuring that no malicious scripts are configured in torrent completion actions reduces the impact of potential token theft by limiting the consequences of unauthorized API calls even if an attacker manages to obtain a valid session ID.