CVE-2026-3193 Chia Blockchain send_transaction cross-site request forgery
An attacker can perform cross-site request forgery on the Chia Blockchain send_transaction endpoint to modify data, though exploitation is difficult.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-3193?
CVE-2026-3193 is a low-severity vulnerability in Chia Blockchain, published on 25 Feb 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site request forgery. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is considered difficult. The exploit is now public and may be used. The vendor was informed early via email. A separate report via bugbounty was rejected with the reason "This is by design. The user is responsible for host security".
Which versions are affected by CVE-2026-3193?
It affects 1 product.
Products include Chia Blockchain.
How do I fix CVE-2026-3193?
No fix has been published for CVE-2026-3193 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-3193 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-3193 exists.
Other vulnerabilities in Chia Blockchain
Sources
Also known as GHSA-4g2q-86h2-35w4.