CVE-2026-116071: rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption
rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessing and decrypt the database containing exchange API keys, secrets, wallet addresses and transaction history.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require access to a rotki account or user interaction?
An attacker needs to obtain an uploaded backup blob. They can then perform GPU-parallel password guessing offline to derive the decryption key; no user interaction is required.
Which users should prioritize remediation?
Users of rotki versions before 1.44.2 who use premium cloud backup should prioritize remediation, particularly if their backups contain exchange API keys, secrets, wallet addresses, or transaction history.