rotki vulnerabilities

CVEs whose affected-version data names the rotki package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-116071Medium· 5.9

yesterday

rotki before 1.44.2 Weak Key Derivation for Premium Cloud Backup Encryption

rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob ca…

▾ Sunlitrotki · rotkivia CVEORG