Vulnerability · Published Oct 25, 2026 · Assigned by VulnCheck

CVE-2026-116071rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption

Medium 5.9

In plain English

A medium-severity security flaw in rotki from rotki. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.2%top 90.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.

Affected products (as reported)

Vendor	Product	Versions
rotki	rotki	0 – before 1.44.2

Weakness: CWE-916 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #13393 issue-tracking
https://github.com/rotki/rotki product
https://github.com/rotki/rotki/pull/13401 patch, issue-tracking
https://github.com/rotki/rotki/blob/v1.44.1/rotkehlchen/crypto.py#L17-L45 technical-description
https://github.com/rotki/rotki/blob/v1.44.1/rotkehlchen/data_handler.py#L263-L294 technical-description
v1.44.2 Release Notes release-notes
VulnCheck Advisory: rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption third-party-advisory