Security readout for executives and security teams
Plain-English summary
Chia Blockchain 2.1.0 has a reported cross-site request forgery issue in /send_transaction. A user could be tricked into causing a transaction action, but exploitation is rated difficult and requires user interaction. The listed impact is limited integrity loss. There is no cited evidence of active exploitation.
Executive priority
Treat as routine unless Chia 2.1.0 systems manage valuable funds or are broadly reachable. In those cases, prioritize near-term exposure reduction and monitoring while checking vendor guidance.
Technical view
CVE-2026-3193 affects Chia Blockchain 2.1.0, involving an unknown function in /send_transaction. It is classified as CWE-352 and CWE-862. CVSS 3.1 is 3.1: AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N. VulDB reports public exploit availability; the bundle marks the GitHub exploit reference as broken-link.
Likely exposure
Relevant exposure is limited to organizations running Chia Blockchain 2.1.0 where transaction functionality is reachable from user browsing contexts. Evidence only names version 2.1.0. Hosts controlling valuable wallets or broadly accessible management surfaces deserve closer review.
Exploitation context
The attack is remote but high-complexity and requires user interaction. Sources report the exploit is public, but KEV is false and no provided source confirms in-the-wild exploitation. Expected impact is unauthorized transaction submission risk, not data theft or service outage.
Researcher notes
Evidence is sparse. VulDB says the impacted function is unknown and reports a rejected bounty response: "This is by design. The user is responsible for host security." Do not assume other Chia versions are affected without confirmation.
Mitigation direction
- Identify Chia Blockchain 2.1.0 instances and prioritize transaction-capable systems.
- Check Chia or vendor guidance for supported fixes or configuration recommendations.
- Reduce browser-accessible exposure to transaction functionality using host and network access controls.
- Avoid browsing untrusted sites from sessions used to manage Chia transactions.
- Monitor Chia transaction activity for unexpected sends until vendor guidance is clarified.
Validation and detection
- Confirm installed Chia Blockchain versions against asset inventory.
- Verify whether /send_transaction is reachable from user workstations or browsers.
- Review access controls protecting transaction-capable Chia hosts.
- Check logs and wallet records for unexpected transaction attempts.
- Document compensating controls around Chia transaction administration.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-352: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-862: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-3193 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 3.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R1.61.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
3.1LowVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
Source materials
- CVE List V5 sourceCVE List V5
- VDB-347749 | Chia Blockchain send_transaction cross-site request forgeryCVE reference · vdb-entry
- VDB-347749 | CTI Indicators (IOB, IOC, IOA)CVE reference · signature, permissions-required
- https://github.com/Danimlzg/chia-rpc-auth-bypass.gitCVE reference · broken-link, exploit
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Missing Authorization
Missing Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.