CVE-2026-3194
📋 TL;DR
This vulnerability allows local attackers to bypass authentication in Chia Blockchain's RPC server master passphrase handler, potentially accessing private keys or sending unauthorized transactions. Only affects Chia Blockchain 2.1.0 users with local access to the system. The vendor considers this 'by design' and places responsibility on users for host security.
💻 Affected Systems
- Chia Blockchain
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Local attacker gains unauthorized access to private keys and can steal cryptocurrency assets or manipulate blockchain transactions.
Likely Case
Local user with malicious intent could access wallet functions they shouldn't have permission to use.
If Mitigated
With proper host security controls, impact is minimal as it requires local access.
🎯 Exploit Status
Exploit requires local access and technical knowledge of Chia Blockchain RPC interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: None
Restart Required: No
Instructions:
No official patch available. Vendor rejected bug report stating this is 'by design' and user is responsible for host security.
🔧 Temporary Workarounds
Disable RPC Server
allTurn off the RPC server if not required for your use case
chia stop all
Disable chia services from auto-starting
Restrict Local Access
allImplement strict access controls to prevent unauthorized local users from accessing the system
Use firewall rules to restrict local network access to Chia RPC port
Implement user account controls
🧯 If You Can't Patch
- Implement strict host security controls including user access restrictions and monitoring
- Isolate Chia Blockchain nodes on dedicated systems with no other users or services
🔍 How to Verify
Check if Vulnerable:
Check if running Chia Blockchain version 2.1.0 with RPC server enabledCheck Version:
chia versionVerify Fix Applied:
Verify Chia Blockchain is not version 2.1.0 or RPC server is disabled📡 Detection & Monitoring
Log Indicators:
- Unauthorized RPC calls to send_transaction or get_private_key functions
- Failed authentication attempts followed by successful RPC operations
Network Indicators:
- Local network connections to Chia RPC port (typically 8555) from unexpected sources
SIEM Query:
source="chia.log" AND ("send_transaction" OR "get_private_key") AND NOT "authenticated"