CVE-2026-116071 Details
Description
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.
A vulnerability exists in Rotki versions prior to 1.44.2, where the encryption for premium cloud backups is derived from a single unsalted SHA-256 hash of the user's password. This weak key derivation allows attackers to brute-force encrypted backups, especially when using GPU acceleration. The decrypted database can reveal sensitive information such as exchange API keys, wallet addresses, and transaction history.
Users can upgrade to Rotki version 1.44.2 or later, where this vulnerability has been addressed. Instructions for downloading the latest version are available on the Rotki GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 25, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/rotki/rotki | [email protected] | Vendor |
| https://github.com/rotki/rotki/blob/v1.44.1/rotkehlchen/crypto.py#L17-L45 | [email protected] | Source CodeVendor |
| https://github.com/rotki/rotki/blob/v1.44.1/rotkehlchen/data_handler.py#L263-L294 | [email protected] | Source CodeVendor |
| https://github.com/rotki/rotki/issues/13393 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/rotki/rotki/pull/13401 | [email protected] | Issue TrackingVendor |
| https://github.com/rotki/rotki/releases/tag/v1.44.2 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/rotki-before-1.44.2-weak-key-derivation-for-premium-cloud-backup-encryption | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| rotki | >= 0, < 1.44.2 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 25, 2026 | New CVE Received | [email protected] |