PT-2026-7886 · Unknown · Matrix-Tools+2

Wrjlewis · Published 2026-02-12 · Updated 2026-02-13 · CVE-2026-24044

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Element Server Suite Community Edition (ESS Community) versions prior to 25.12.1

Description The Element Server Suite Community Edition (ESS Community) Helm Chart contains a flaw in its secrets initialization hook, specifically within the matrix-tools container before version 0.5.7. This issue involves an insecure method for generating Matrix server keys. A network attacker could potentially recreate the same key pair, enabling server impersonation. This impacts the confidentiality, integrity, and availability of rooms with the vulnerable server as a member. The confidentiality of past end-to-end encrypted conversations is not affected. The issue stems from the generation of the secret within the ESS Community Helm Chart values when initSecrets.enabled is not set to false and synapse.signingKey is not defined.

Recommendations Update to ESS Community Helm Chart version 25.12.1 or later. Ensure initSecrets.enabled is set to false in the ESS Community Helm Chart values. Define synapse.signingKey in the ESS Community Helm Chart values.

Exploit

Fix

Weakness Enumeration

CWE-336

Related Identifiers

CVE-2026-24044

GHSA-QWCJ-H6M8-VP6Q

OPENSUSE-SU-2026:10196-1

Affected Products

Ess Community Helm Chart

Element Server Suite Community Edition

Matrix-Tools

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24044.json · Exploit
• 🔥 https://github.com/element-hq/ess-helm/blob/main/docs/maintenance.md#fixing-cve-2026-24044elementsec-2025-1670-manually · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-24044 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10196-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24044 · Vendor Advisory
• https://github.com/element-hq/ess-helm/security/advisories/GHSA-qwcj-h6m8-vp6q · Note
• https://github.com/element-hq/ess-helm/releases/tag/25.12.2 · Note
• https://suse.com/security/cve/CVE-2026-24044 · Note
• https://twitter.com/offseq/status/2022234359902695492 · Twitter Post
• https://twitter.com/CVEnew/status/2022037597954920809 · Twitter Post