PT-2026-21963 · Unknown · Chia Blockchain

Danimlzg · Publicado 2026-02-25 · Atualizado 2026-03-05 · CVE-2026-3193

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Chia Blockchain version 2.1.0

Description A cross-site request forgery condition exists in Chia Blockchain version 2.1.0. The issue is related to an unknown function within the /send transaction file. The attack can be performed remotely and requires a high level of complexity, with exploitability considered difficult. The exploit is publicly available. The vendor was informed of the issue, but a bug bounty report was rejected with the justification that the issue is by design and user host security is the responsibility of the user.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Missing Authorization

Enumeração de Fraquezas

CWE-352

CWE-862

Identificadores relacionados

CVE-2026-3193

Produtos afetados

Chia Blockchain

Referências · 8

• 🔥❌ https://github.com/Danimlzg/chia-rpc-auth-bypass.git · Exploit, Deleted
• https://twitter.com/infoflowcloud/status/2027100367243129070 · Publicação no Twitter
• https://vuldb.com/?id.347749 · Nota
• https://t.me/cveNotify/154245 · Publicação no Telegram
• https://vuldb.com/?ctiid.347749 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-3193 · Nota de Segurança
• https://twitter.com/CVEnew/status/2027099317325172795 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-3193 · Aviso do Fabricante