CVE-2026-3194 | Chia Blockchain 2.1.0 RPC Server Master Passphrase send_transaction/get_private_key missing authentication

A vulnerability has been found in Chia Blockchain 2.1.0 and classified as critical. The affected element is the function send_transaction/get_private_key of the component RPC Server Master Passphrase Handler. This manipulation causes missing authentication.

The identification of this vulnerability is CVE-2026-3194. The attack can only be executed locally. Furthermore, there is an exploit available.

The vendor was informed early via email. A separate report via bugbounty was rejected with the reason “This is by design. The user is responsible for host security”.