Weak key derivation in rotki premium cloud backup encryption
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
rotki before 1.44.2 uses a single unsalted SHA-256 of the user password as the premium sync key, which is a weak key derivation (CWE-916). An attacker who obtains an uploaded premium cloud backup can run offline password guessing on a GPU and decrypt the database, which contains exchange API keys, secrets, wallet addresses and transaction history. No unauthenticated network access is needed beyond obtaining the backup blob.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
Update rotki to version 1.44.2 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA rotki (rotki) Fixed in 1.44.2
Timeline
- 2026-10-25 Threatist record created from CVE-2026-116071
- 2026-10-26 Priority changed: MEDIUM → LOW
- 2026-10-27 Alias added: GHSA-qgg8-6p8q-vrp7
- 2026-10-29 CISA SSVC decision points changed
References
Sources
- CVE-2026-116071 · CVE Program
- CVE-2026-116071 · NVD
- FIRST EPSS
- GHSA-qgg8-6p8q-vrp7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences