CVE-2026-116748 Transmission 4.0.0 before 4.1.3 Permissive CORS Leaks RPC Anti-CSRF Token

High 8.7 Published 26 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-116748?

CVE-2026-116748 is a high-severity vulnerability in transmission, published on 26 Oct 2026.

Official description

Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.

Weakness: CWE-942

Which versions are affected by CVE-2026-116748?

How do I fix CVE-2026-116748?

Upgrade to a fixed version.

Is CVE-2026-116748 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-116748 exists.

Public exploit code: 1 Nuclei template.

Sources

Also known as DEBIAN-CVE-2026-116748, GHSA-jw4h-7968-5hj9, UBUNTU-CVE-2026-116748.