Weak Key Derivation in Rotki Before Version 1.44.2
CVE-2026-116071

8.2HIGH

Key Information:

Vendor

Rotki

Status
Rotki
Vendor
CVE Published:
25 October 2026

What is CVE-2026-116071?

Rotki prior to version 1.44.2 is susceptible to a weak key derivation issue where the premium sync key is derived from an unsalted SHA-256 hash of the user password. This allows attackers to exploit uploaded backup files by executing GPU-parallel offline password guessing attacks, potentially decrypting sensitive information such as exchange API keys, secrets, wallet addresses, and transaction history. Users are strongly encouraged to upgrade to version 1.44.2 or later to mitigate this risk.

Affected Version(s)

rotki 0 < 1.44.2

References

https://github.com/rotki/rotki/issues/13393
issue-tracking
https://github.com/rotki/rotki
product
https://github.com/rotki/rotki/pull/13401
patchissue-tracking

CVSS V4

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.