PT-2026-21945 · Unknown · Chia Blockchain

Danimlzg · Published 2026-02-25 · Updated 2026-03-05 · CVE-2026-3192

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chia Blockchain version 2.1.0

Description A security issue has been identified in Chia Blockchain that results in improper authentication. This is due to manipulation within the authenticate function located in the rpc server base.py file of the RPC Credential Handler component. The attack can be carried out remotely and is considered to have high complexity, with difficult exploitability. The exploit has been publicly disclosed. The vendor was notified of the issue but rejected a bug bounty report, stating the behavior is intentional and the user is responsible for host security.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2026-3192

Affected Products

Chia Blockchain

References · 8

• 🔥❌ https://github.com/Danimlzg/chia-rpc-auth-bypass.git · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2026-3192 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3192 · Security Note
• https://vuldb.com/?ctiid.347748 · Note
• https://vuldb.com/?id.347748 · Note
• https://twitter.com/CVEnew/status/2027744273169314087 · Twitter Post
• https://t.me/CVEtracker/45737 · Telegram Post
• https://t.me/cveNotify/154244 · Telegram Post