CVE-2026-116071
rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption
rotki rotki
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 1.44.2rotkiCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.
Text from CVE List
Affected versions 1
- rotkiaffected: all versions before 1.44.2CVE List
References 7
- github.com/rotki/rotki/pull/13401Fixvia CVE List
- github.com/rotki/rotki/releases/tag/v1.44.2Fixvia CVE List
- vulncheck.com/advisories/rotki-before-1.44.2-weak-key-derivation-for-premium-cloud-backup-encryptionAdvisoryvia CVE List
- github.com/rotki/rotki/issues/13393Referencevia CVE List
- github.com/rotki/rotkiReferencevia CVE List
- github.com/rotki/rotki/blob/v1.44.1/rotkehlchen/crypto.py#L17-L45Referencevia CVE List
- github.com/rotki/rotki/blob/v1.44.1/rotkehlchen/data_handler.py#L263-L294Referencevia CVE List