CVE-2026-38978: Transmission Clickjacking Vulnerability

CVE-2026-38978 Overview

CVE-2026-38978 affects Transmission BitTorrent client through version 4.1.1. The vulnerability is a clickjacking weakness in the browser-facing WebUI and RPC response paths. Attackers can frame the Transmission WebUI inside a malicious page and trick authenticated users into performing unintended actions. These actions include adding, removing, or modifying torrents through forged interface interactions.

The vulnerability resides in the absence of clickjacking protections such as X-Frame-Options headers or a restrictive Content Security Policy frame-ancestors directive. Public references on GitHub document the issue and the corresponding fix.

Critical Impact
Authenticated WebUI users visiting attacker-controlled pages can unknowingly issue torrent management commands via UI redress attacks.

Affected Products

Transmission BitTorrent client versions through 4.1.1
Transmission WebUI component
Transmission RPC interface response paths

Discovery Timeline

2026-06-02 - CVE-2026-38978 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-38978

Vulnerability Analysis

The vulnerability allows attackers to embed the Transmission WebUI in a hidden iframe on a malicious page. When an authenticated user visits the attacker-controlled site, overlaid UI elements direct clicks toward sensitive Transmission controls. The browser submits these requests with the user's authenticated session, allowing the attacker to manipulate torrents without consent.

The weakness extends to RPC response paths. Responses from the Transmission RPC interface lack framing restrictions and content-type enforcement that browsers use to block embedding and content sniffing. This widens the attack surface beyond the WebUI alone. See the GitHub Issue Report for the original problem description.

Root Cause

The root cause is missing browser-side framing protections on HTTP responses served by Transmission. Without X-Frame-Options: DENY or a Content-Security-Policy containing frame-ancestors 'none', browsers permit arbitrary sites to load the WebUI in frames. The RPC response paths similarly omit hardened security headers, leaving them open to UI redress techniques.

Attack Vector

An attacker hosts a webpage that loads the victim's local or remote Transmission WebUI URL in an invisible iframe. The page overlays decoy buttons aligned with sensitive controls in the framed interface. When the victim clicks a decoy, the click is dispatched to the underlying Transmission control. Because the victim already holds an authenticated session, Transmission processes the request as legitimate. Review the GitHub Pull Request for the implemented mitigation.

No verified exploit code is publicly available. The vulnerability mechanism is described in prose based on the upstream issue and patch references.

Detection Methods for CVE-2026-38978

Indicators of Compromise

Unexpected torrents appearing in or disappearing from the Transmission queue without user action
Browser referer logs showing third-party origins loading the Transmission WebUI URL
Sudden changes to Transmission settings such as download directories or speed limits
HTTP responses from Transmission lacking X-Frame-Options or Content-Security-Policy: frame-ancestors headers

Detection Strategies

Inspect HTTP responses from the Transmission WebUI and RPC endpoints for missing framing headers
Compare installed Transmission version against the fixed release referenced in the upstream commit
Monitor proxy or web gateway logs for cross-origin requests targeting the Transmission interface port

Monitoring Recommendations

Alert on torrent add, remove, and modify RPC calls originating from sessions tied to unusual referer headers
Track WebUI access patterns and flag activity initiated from non-bookmarked, third-party origins
Audit configuration changes to the Transmission daemon through file integrity monitoring

How to Mitigate CVE-2026-38978

Immediate Actions Required

Upgrade Transmission to a release that includes the fix from commit 6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8
Restrict WebUI access to localhost or trusted network ranges using rpc-whitelist and rpc-host-whitelist
Require authentication on the WebUI and use unique credentials not shared with other services

Patch Information

The fix is published in the upstream repository. Review the GitHub Commit Details and the merged GitHub Pull Request for the applied changes. The patch adds framing restrictions to browser-facing responses.

Workarounds

Place Transmission behind a reverse proxy that injects X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none' headers
Bind the WebUI to 127.0.0.1 and access it through an SSH tunnel rather than exposing it to the network
Log out of the Transmission WebUI when not in active use to limit the window for session-bound attacks

bash

# Reverse proxy header hardening example (nginx)
location /transmission/ {
    proxy_pass http://127.0.0.1:9091/transmission/;
    add_header X-Frame-Options "DENY" always;
    add_header Content-Security-Policy "frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
}