What is the CVSS score of CVE-2026-38978?

CVE-2026-38978 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Transmission CVE-2026-38978

EUVD-2026-33971 MEDIUM

HTTP Response Splitting (CWE-113)

2026-06-02 mitre

GHSA-6rg3-8m29-j28q

Information Disclosure N A

5.3

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 05, 2026 - 21:03 vuln.today

Analysis Generated

Jun 05, 2026 - 21:03 vuln.today

CVSS changed

Jun 05, 2026 - 18:22 NVD

5.3 (MEDIUM)

CVE Published

Jun 02, 2026 - 00:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

transmission through 4.1.1 was found to have a clickjacking weakness in the browser-facing WebUI and RPC response paths.

AnalysisAI

Transmission BitTorrent client through version 4.1.1 fails to emit anti-clickjacking HTTP response headers on its browser-facing WebUI and RPC endpoint, enabling an attacker to embed the interface in a cross-origin iframe and redirect authenticated user interactions to unintended RPC actions. The fix confirmed in upstream PR #8747 adds both X-Frame-Options: SAMEORIGIN and Content-Security-Policy: frame-ancestors 'self' to all relevant responses. No public exploit has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) indicates low current exploitation interest.

Technical ContextAI

Transmission includes a built-in HTTP server (libtransmission/rpc-server.cc) that serves a browser-based WebUI and JSON-RPC endpoint, typically on TCP port 9091. The vulnerability exists because HTTP responses from this server omit framing-control headers, allowing any cross-origin page to load the interface in an iframe without browser enforcement. The assigned CWE is CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers), which describes HTTP response splitting via injected headers - this appears to be an imprecise classification for a missing-header clickjacking issue, which more accurately maps to CWE-1021 (Improper Restriction of Rendered UI Layers or Frames). The upstream fix in commit 6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8 adds evhttp_add_header calls emitting X-Frame-Options: SAMEORIGIN (for legacy browser compatibility) and Content-Security-Policy: frame-ancestors 'self' (for modern browsers), consistent with OWASP Clickjacking Defense Cheat Sheet guidance referenced in the patch comments. The CPE data provided (cpe:2.3:a:n/a:n/a) is non-specific and not useful for inventory matching - affected versions must be identified directly from the Transmission project.

RemediationAI

An upstream fix is available via GitHub PR #8747 (https://github.com/transmission/transmission/pull/8747) and commit 6b24c1c214ec6a44fa5fdff0ce7da6b16d8ecaa8 - however, a released patched version is not independently confirmed from the provided data; monitor the Transmission releases page for an official tagged version incorporating this commit before deploying. As an immediate compensating control, restrict access to the Transmission RPC/WebUI port (default TCP 9091) to localhost or a specific trusted internal subnet using host-based firewall rules (e.g., iptables, ufw, or Windows Firewall); this eliminates the cross-origin reachability that clickjacking requires, with the trade-off of removing remote WebUI access. Enabling Transmission's built-in HTTP authentication adds a credential barrier and reduces passive session exposure, but does not mitigate clickjacking against an already-authenticated session. Do not expose TCP 9091 directly to the internet without the patched headers in place.