CVE-2026-116748
Description
A flaw was found in Transmission. This vulnerability allows a remote attacker to execute arbitrary code, modify application settings, or delete data by exploiting an overly permissive Cross-Origin Resource Sharing (CORS) policy in the remote procedure call (RPC) server. By tricking a user into visiting a malicious website, an attacker can capture the exposed session token from handshake responses and replay it to issue unauthorized RPC commands to the local Transmission service.
Statement
This vulnerability is rated as Important because an attacker can achieve code execution or data destruction in the context of the user running Transmission by leveraging cross-origin requests from a malicious webpage. While exploitation requires user interaction to visit a compromised site, the lack of origin validation allows direct compromise of the remote procedure call service without prior system access. Transmission is not included in core Red Hat Enterprise Linux releases, limiting exposure primarily to Extra Packages for Enterprise Linux (EPEL) and Fedora environments.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
