CVE-2026-116748 transmission CVE debrief

Who should care

Defenders responsible for Transmission installations, particularly those using versions 4.0.0 before 4.1.3, should assess exposure and prioritize verification and remediation. This includes reviewing and updating Transmission to version 4.1.3 or later, monitoring for potential unauthorized RPC calls, and implementing compensating controls for exposed systems. Additionally, defenders should review asset inventory for affected systems, track exceptions, and

Why it matters

CVE-2026-116748 is a high-severity vulnerability in Transmission 4.0.0 before 4.1.3, allowing malicious web pages to read the RPC anti-CSRF token and issue unauthorized RPC calls, potentially leading to data deletion or changes. Defenders should prioritize verifying exposure and assessing potential impact.

• Potential unauthorized RPC calls, allowing for data deletion or changes
• Exposure of sensitive information, such as the X-Transmission-Session-Id anti-CSRF token
• Possible script-torrent-done execution, download-dir changes, or torrent and data deletion

Technical summary

The vulnerability is caused by a permissive CORS configuration in the rpc-server.cc file, which exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. This allows malicious web pages to read the token from the 409 handshake response and replay it to issue RPC calls, potentially leading to data deletion or changes. The affected product context indicates that defenders should prioritize verifying exposure and assessing potential impact, as this vulnerability allows for unauthorized RPC calls. The technical framing of this vulnerability highlights the importance of reviewing and updating Transmission to version 4.1.3 or later.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, as this vulnerability allows for unauthorized RPC calls, potentially leading to data deletion or changes.

Recommended defensive actions

• Verify Transmission version and assess exposure
• Review and update Transmission to version 4.1.3 or later
• Monitor for potential unauthorized RPC calls
• Implement compensating controls for exposed systems
• Review asset inventory for affected systems
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, CVSS score, and affected versions. However, limited information is available on potential exploits or victims.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.