CVE-2026-116748: Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID

id: CVE-2026-116748

info:
  name: Transmission 4.0.0-4.1.2 - Permissive CORS Exposes RPC Session ID
  author: kosoyyagent
  severity: medium
  description: |
    Transmission 4.0.0 through 4.1.2 sends Access-Control-Allow-Origin: * on RPC responses and advertises X-Transmission-Session-Id via Access-Control-Expose-Headers on the 409 session handshake. Any website a user visits can read the session-id nonce that guards against CSRF, enabling cross-origin control of the daemon's RPC API.
  impact: |
    Attackers can perform unauthorized RPC calls to execute scripts, change download directories, or delete torrents and data.
  remediation: |
    Upgrade to Transmission 4.1.3 or later, which removes the CORS headers from the RPC server (commit c6a1bd20). Additionally restrict rpc-whitelist / enable rpc authentication.
  reference:
    - https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e
    - https://github.com/transmission/transmission/pull/8938
    - https://nvd.nist.gov/vuln/detail/CVE-2026-116748
  classification:
    cve-id: CVE-2026-116748
    epss-score: 0.01246
    epss-percentile: 0.69498
    cwe-id: CWE-942
  metadata:
    verified: true
    max-request: 1
    shodan-query: '"X-Transmission-Session-Id"'
  tags: cve,cve2026,transmission,cors,misconfig

http:
  - method: GET
    path:
      - "{{BaseURL}}/transmission/rpc"
    headers:
      Origin: "https://oast.pro"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "Access-Control-Expose-Headers"
          - "X-Transmission-Session-Id"
        condition: and

      - type: word
        part: header
        words:
          - "Access-Control-Allow-Origin: *"

      - type: status
        status:
          - 409
# digest: 490a004630440220559d7bd30a4ea773a96613bd244feaf8c8c23fe0b94bff476de0d3864d84a1e302205714ac8ab69a6ef929db7e0efb3e019937184da654e6738b9d38a7c50b269c16:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.