Vulnerability · Published Feb 25, 2026 · Assigned by VulDB

CVE-2026-3193Chia Blockchain send_transaction cross-site request forgery

Low 3.1

In plain English

A low-severity cross-site request forgery in Blockchain from Chia. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).

Severity (CVSS 3.1)3.1Low

Exploit odds (30 days)0.2%top 83.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site request forgery. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was informed early via email. A separate report via bugbounty was rejected with the reason "This is by design. The user is responsible for host security".

Affected products (as reported)

Vendor	Product	Versions
Chia	Blockchain	2.1.0

Weakness: CWE-352, CWE-862 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R

References

VDB-347749 | Chia Blockchain send_transaction cross-site request forgery vdb-entry
VDB-347749 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
https://github.com/Danimlzg/chia-rpc-auth-bypass.git broken-link, exploit