CVE-2026-3192
Improper Authentication in Chia Blockchain RPC Allows Remote Access
Publication date: 2026-02-25
Last updated on: 2026-04-29
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chia | blockchain | 2.1.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-306 | The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. |
| CWE-287 | When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3192 is a security vulnerability in Chia Blockchain version 2.1.0, specifically in the _authenticate function of the rpc_server_base.py file within the RPC Credential Handler component.
The vulnerability causes improper authentication, meaning the system fails to properly verify the identity of users or actors attempting to access it.
This flaw can be exploited remotely without prior authentication, allowing attackers to bypass authentication controls.
Although the exploitability is considered difficult and the attack complexity is high, a proof-of-concept exploit is publicly available.
How can this vulnerability impact me? :
This vulnerability impacts the confidentiality, integrity, and availability of the affected system.
Because attackers can bypass authentication remotely, they may gain unauthorized access to sensitive data or system functions.
Such unauthorized access could lead to data breaches, manipulation of data, or disruption of services.
No known mitigations or countermeasures have been provided, so affected users are advised to consider replacing the vulnerable component.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There are no specific detection methods or commands provided to identify this vulnerability on your network or system.
What immediate steps should I take to mitigate this vulnerability?
No known countermeasures or mitigations have been provided for this vulnerability.
It is suggested that users consider replacing the affected component with an alternative product.