Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID

mediumseverity

1.2%likelihood of exploitation, next 30 days

70%of all CVEs are less likely

Readycheck to confirm it

Transmission 4.0.0 through 4.1.2 sends Access-Control-Allow-Origin: * on RPC responses and advertises X-Transmission-Session-Id via Access-Control-Expose-Headers on the 409 session handshake. Any website a user visits can read the session-id nonce that guards against CSRF, enabling cross-origin control of the daemon's RPC API.

Impact

Attackers can perform unauthorized RPC calls to execute scripts, change download directories, or delete torrents and data.

Fix

Upgrade to Transmission 4.1.3 or later, which removes the CORS headers from the RPC server (commit c6a1bd20). Additionally restrict rpc-whitelist / enable rpc authentication.

How to confirm it

Send: GET {{BaseURL}}/transmission/rpc
Positive when: contains in header "Access-Control-Expose-Headers" and "X-Transmission-Session-Id" AND contains in header "Access-Control-Allow-Origin: *" AND status 409

Run it with nuclei: nuclei -id CVE-2026-116748 -u <target>

The full check

id: CVE-2026-116748

info:
  name: Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID
  author: kosoyyagent
  severity: medium
  description: |
    Transmission 4.0.0 through 4.1.2 sends Access-Control-Allow-Origin: * on RPC responses and advertises X-Transmission-Session-Id via Access-Control-Expose-Headers on the 409 session handshake. Any website a user visits can read the session-id nonce that guards against CSRF, enabling cross-origin control of the daemon's RPC API.
  impact: |
    Attackers can perform unauthorized RPC calls to execute scripts, change download directories, or delete torrents and data.
  remediation: |
    Upgrade to Transmission 4.1.3 or later, which removes the CORS headers from the RPC server (commit c6a1bd20). Additionally restrict rpc-whitelist / enable rpc authentication.
  reference:
    - https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e
    - https://github.com/transmission/transmission/pull/8938
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116748
  classification:
    cve-id: CVE-2026-116748
    epss-score: 0.01246
    epss-percentile: 0.69546
    cwe-id: CWE-942
  metadata:
    verified: true
    max-request: 1
    shodan-query: '"X-Transmission-Session-Id"'
  tags: cve,cve2026,transmission,cors,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/transmission/rpc"
    headers:
      Origin: "https://oast.pro"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Access-Control-Expose-Headers"
          - "X-Transmission-Session-Id"
        condition: and

      - type: word
        part: header
        words:
          - "Access-Control-Allow-Origin: *"

      - type: status
        status:
          - 409

References

Use this check only on systems you are authorised to test. Where the data comes from