Home

Description

A flaw has been found in Chia Blockchain 2.1.0. The affected element is the function send_transaction/get_private_key of the component RPC Server Master Passphrase Handler. This manipulation causes missing authentication. The attack can only be executed locally. The attack's complexity is rated as high. The exploitability is described as difficult. The exploit has been published and may be used. The vendor was informed early via email. A separate report via bugbounty was rejected with the reason "This is by design. The user is responsible for host security".

PUBLISHED Reserved 2026-02-25 | Published 2026-02-25 | Updated 2026-02-25 | Assigner VulDB




LOW: 2.0CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
MEDIUM: 4.5CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
MEDIUM: 4.5CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
3.5AV:L/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR

Problem types

Missing Authentication

Improper Authentication

Product status

2.1.0
affected

Timeline

2026-02-25:Advisory disclosed
2026-02-25:VulDB entry created
2026-02-25:VulDB entry last update

Credits

DeSneake (VulDB User) reporter

References

vuldb.com/?id.347750 (VDB-347750 | Chia Blockchain RPC Server Master Passphrase get_private_key missing authentication) vdb-entry technical-description

vuldb.com/?ctiid.347750 (VDB-347750 | CTI Indicators (IOB, IOC, IOA)) signature permissions-required

vuldb.com/?submit.757201 (Submit #757201 | Chia Network Chia Blockchain Chia Blockchain 2.1.0 (confirmed vulnerable) Later versions (2.2.0 - 2.5.6) presumed vulnerable - no fix released Authentication Bypass/CSRF/Cryptographic Issue) third-party-advisory

github.com/Danimlzg/chia-rpc-auth-bypass.git broken-link exploit

cve.org (CVE-2026-3194)

nvd.nist.gov (CVE-2026-3194)

Download JSON