Live › vulnerability › CVE-2026-116071
Go to dashboardrotki derives its premium sync encryption key as a single unsalted SHA-256 of the user password. An attacker who obtains an uploaded backup can guess passwords offline on GPUs and decrypt the database, which holds exchange API keys, secrets, wallet addresses and transaction history.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-25 12:40 UTC. All times on this page are UTC.
Users of rotki premium sync before 1.44.2 whose encrypted backups are stored on the sync service. Someone who only runs rotki locally without premium sync uploads is not exposed through this path.
No product ranges from the sources yet.
1.44.2 are affected.1.44.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.
This page as .md · .json · in your agent: get_signal("CVE-2026-116071")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.