CVE-2026-116071 in rotki
Summary
by MITRE • 10/25/2026
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/25/2026
The vulnerability identified in rotki versions prior to 1.44.2 represents a critical failure in cryptographic key derivation practices that fundamentally compromises the confidentiality of user data stored within local backups. The core technical flaw lies in the method used to generate the encryption key for premium sync operations, where the system relies on a single iteration of the SHA-256 hash function applied directly to the user's password without any salt or computational cost parameters such as those found in modern Key Derivation Functions like PBKDF2, scrypt, or Argon2. This approach results in a static, unsalted digest that serves as the symmetric key for encrypting sensitive database contents including exchange API keys, private wallet addresses, and detailed transaction histories. Because SHA-256 is designed to be computationally fast rather than resistant to brute-force attacks, it fails to provide the necessary delay required to thwart offline password guessing attempts.
The operational impact of this weakness is severe for any user who has utilized the premium sync feature or exported a backup file that was encrypted with their account credentials. An attacker who gains access to an uploaded backup blob can immediately initiate high-speed offline cryptanalysis using modern GPU clusters capable of performing billions of hash computations per second. The absence of salt means that attackers do not need unique rainbow tables for each user, allowing them to apply precomputed lookup tables or generic brute-force dictionaries efficiently against multiple targets simultaneously. Once the password is recovered through this process, the attacker gains full decryption capabilities over the entire database, exposing highly sensitive financial information and potentially enabling unauthorized access to connected cryptocurrency exchanges via stolen API keys with read-write permissions.
This vulnerability aligns closely with CWE-759: Use of a One-Way Hash without a Salt in security standards classifications, highlighting the improper application of cryptographic primitives for password-based key derivation. From an offensive security perspective as mapped by MITRE ATT&CK, this flaw facilitates T1492: Stored Data Tampering and potentially T1003: OS Credential Dumping if the decrypted data is used to pivot into other systems via compromised API credentials. The lack of salting also relates to CWE-780: Use of RSA Algorithm for Password Storage when considering the broader context of weak password hashing, although here it specifically pertains to key derivation integrity rather than direct authentication storage.
To mitigate this risk, users must upgrade immediately to rotki version 1.44.2 or later where the developers have implemented a robust key derivation function that incorporates salt and increased computational cost parameters such as PBKDF2-HMAC-SHA512 with appropriate iteration counts. For existing installations affected by this vulnerability, it is imperative to rotate all API keys associated with connected exchanges immediately after upgrading, assuming any backups were potentially compromised during the period of weakness. Additionally, users should enforce strong password policies that include high entropy and length requirements to provide a secondary layer of defense against offline guessing attacks even if future implementations retain minor weaknesses in key derivation parameters. Regular auditing of backup encryption methods and adherence to NIST guidelines for cryptographic storage will ensure long-term resilience against evolving cryptanalytic techniques.