{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-24044 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-24044 is a critical vulnerability in element-hq ess-helm, published on 12 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-24044 and fix it if it is affected.\n\nWhat it is: CVE-2026-24044 is a critical vulnerability in element-hq ess-helm, published on 12 Feb 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-24044 in the wild and no public exploit code.\n\nAffected product: element-hq ess-helm. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-24044/ (Markdown: https://insights.sbomify.com/CVE-2026-24044/index.md)","id":"CVE-2026-24044","markdown":"https://insights.sbomify.com/CVE-2026-24044/index.md","name":"CVE-2026-24044","record":{"aliases":["GHSA-qwcj-h6m8-vp6q","openSUSE-SU-2026:10196-1"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"upgrade","impacts":["security_bypass","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Matrix Helm Chart","requires_auth":"none","summary":"Weak server key generation in ESS Community Helm Chart allows attackers to impersonate servers, compromising room integrity and availability.","user_interaction":"not_required","vuln_class":"weak_cryptography"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":9.2,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-336","name":"Same Seed in Pseudo-Random Number Generator (PRNG)"}],"description":"Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution. The ESS Community Helm Chart secrets initialization hook (using matrix-tools container before 0.5.7) is using an insecure Matrix server key generation method, allowing network attackers to potentially recreate the same key pair, allowing them to impersonate the victim server. The secret is generated by the secrets initialization hook, in the ESS Community Helm Chart values, if both initSecrets.enabled is not set to false and synapse.signingKey is not defined. Given a server key in Matrix authenticates both requests originating from and events constructed on a given server, this potentially impacts confidentiality, integrity and availability of rooms which have a vulnerable server present as a member. The confidentiality of past conversations in end-to-end encrypted rooms is not impacted. The key generation issue was fixed in matrix-tools 0.5.7, released as part of ESS Community Helm Chart 25.12.1.","ecosystems":["openSUSE:Tumbleweed"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ESS Community Helm Chart has a weak server key generation method","id":"CVE-2026-24044","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"weak_cryptography","year":"2026"},"n_packages":1,"n_references":3,"next":{"headline":"Docmost Affected by Stored XSS in Public Share Page","id":"CVE-2026-24045"},"packages":[{"ecosystem":"openSUSE:Tumbleweed","fixed":["1.147.1-1.1"],"introduced":["0"],"last_affected":[],"package":"matrix-synapse","purl":"pkg:rpm/opensuse/matrix-synapse\u0026distro=openSUSE%20Tumbleweed","source":"openSUSE-SU-2026:10196-1"}],"prev":{"headline":"jsPDF Affected by Stored XMP Metadata Injection (Spoofing \u0026 Integrity Violation)","id":"CVE-2026-24043"},"products":["ess-helm","matrix-tools"],"published":"2026-02-12","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"SUSE","prefix":"openSUSE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-02-12","vendors":["element-hq"]},"summary":"Weak server key generation in ESS Community Helm Chart allows attackers to impersonate servers, compromising room integrity and availability.","url":"https://insights.sbomify.com/CVE-2026-24044/"}