CVE-2026-38978: Medium severity Transmission Transmission vulnerability

Q: Which deployments should be prioritized for review?

Review Transmission installations running version 4.1.1 or earlier that expose or use the browser-facing WebUI or RPC response paths. The supplied data does not identify a later fixed version.

Q: Does exploitation require an authenticated account or network-local access?

The CVSS vector indicates network reachability and no privileges required (AV:N/PR:N). It also specifies no user interaction requirement (UI:N).

Q: What is the expected security impact?

The CVSS assessment rates the issue as low integrity impact, with no confidentiality or availability impact (C:N/I:L/A:N).

Q: How can I determine whether an installation is in scope?

Confirm the installed Transmission version and whether its browser-facing WebUI or RPC response functionality is enabled or reachable. Installations through 4.1.1 are identified as affected.

Published Jun 2, 2026

Updated

Last updated 8 June 2026

Other sources

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

— MITRE

Affected Software

2 affected componentsFixes available

Transmission Transmission<=4.1.1

debian/transmission<=3.00-1, <=3.00-2.1+deb12u1, <=4.1.0~beta2+dfsg-3+deb13u1

4.1.2+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/transmission to a version that resolves this vulnerability.
Fixed in 4.1.2+dfsg-1

Event History

Jun 2, 2026

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeakness

Jun 8, 2026

Data Sourced

via Ubuntu·05:03 PM

RemedyDescriptionSeverityAffected Software

Data Sourced

via Launchpad·05:05 PM

Description

Jun 9, 2026

Data Sourced

via Debian·05:06 PM

DescriptionAffected Software

Frequently Asked Questions

Which deployments should be prioritized for review?

Review Transmission installations running version 4.1.1 or earlier that expose or use the browser-facing WebUI or RPC response paths. The supplied data does not identify a later fixed version.

Does exploitation require an authenticated account or network-local access?

The CVSS vector indicates network reachability and no privileges required (AV:N/PR:N). It also specifies no user interaction requirement (UI:N).

What is the expected security impact?

The CVSS assessment rates the issue as low integrity impact, with no confidentiality or availability impact (C:N/I:L/A:N).

How can I determine whether an installation is in scope?

Confirm the installed Transmission version and whether its browser-facing WebUI or RPC response functionality is enabled or reachable. Installations through 4.1.1 are identified as affected.

CVE-2026-38978: Medium severity Transmission Transmission vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments should be prioritized for review?

Does exploitation require an authenticated account or network-local access?

What is the expected security impact?

How can I determine whether an installation is in scope?

Company

Resources

Contact

Frequently Asked Questions

Which deployments should be prioritized for review?

Does exploitation require an authenticated account or network-local access?

What is the expected security impact?

How can I determine whether an installation is in scope?