Transmission: Permissive CORS exposes RPC anti-CSRF token
Summary
Transmission 4.0.0 before 4.1.3 has a permissive CORS policy in its RPC server that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. A malicious web page visited by a user whose browser can reach the Transmission RPC can read the token and issue RPC calls. Possible outcomes include running a script on torrent completion, changing the download directory, and deleting torrents and data.
Affected
- Transmission 4.0.0 before 4.1.3
- Distribution packages: check the package changelog, as status varies (Ubuntu tracker shows 'Needs evaluation')
Fixed in
- Transmission 4.1.3 (upstream release)
- Distribution packages: unknown for all platforms
Workaround
- Upgrade to 4.1.3 or later; no workaround is needed for patched systems
- Until upgraded, disable remote access to the web UI/RPC or limit it to localhost or a trusted LAN, and enable RPC authentication
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV
- CISA SSVC: exploitation none, automatable no, technical impact total
- A scanner aggregator lists a detection for this issue; this is unverified
- A third-party write-up exists; its contents were not reviewed
Our recommendation
- Inventory Transmission instances, including packaged and container versions
- Upgrade to Transmission 4.1.3 or later and verify distribution packages separately
- Until upgraded, restrict RPC access to localhost or a trusted LAN and enable RPC authentication
- Prioritize systems where a NAS or shared workstation runs Transmission with the web interface enabled
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record / VulnCheck advisory www.vulncheck.com
- Transmission 4.1.3 release github.com
- Fix commit github.com
- Fix pull request #8938 github.com
- Affected code rpc-server.cc (4.1.2) github.com
- Ubuntu security tracker ubuntu.com
- SUSE CVE aggregator (Vulners) vulners.com
- Write-up (joshua.hu) joshua.hu
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 00:04.
Original description (NVD)
Transmission 4.0.0 before 4.1.3 contains a permissive CORS vulnerability in handle_request() in rpc-server.cc that exposes the X-Transmission-Session-Id anti-CSRF token to any web origin. Malicious web pages can read the token from the 409 handshake response and replay it to issue RPC calls, enabling script-torrent-done execution, download-dir changes, or torrent and data deletion.
NVD references (7)
- https://github.com/transmission/transmission
- https://github.com/transmission/transmission/blob/4.1.2/libtransmission/rpc-server.cc#L560
- https://github.com/transmission/transmission/commit/c6a1bd2017a0fea9c956737c213f23e4b0f7929e
- https://github.com/transmission/transmission/pull/8938
- https://github.com/transmission/transmission/releases/tag/4.1.3
- https://joshua.hu/transmission-cors-rpc-csrf-rce-drive-by-exploit
- https://www.vulncheck.com/advisories/transmission-4.0.0-before-4.1.3-permissive-cors-leaks-rpc-anti-csrf-token
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.