CVE-2026-24044

The vulnerability (CWE-336 — use of insufficiently random values) affects the secrets initialization hook in ESS Community Helm Chart, executed by the matrix-tools container in versions before 0.5.7. The applied method for generating the Matrix server key pair is insufficiently secure, allowing a network attacker to potentially reproduce an identical key pair. The issue occurs when the initSecrets.enabled parameter in the Helm Chart configuration is not set to false and synapse.signingKey is not defined — in such a case, the hook automatically generates the key in a vulnerable manner.

An attacker who reproduces the victim's Matrix server key can impersonate that server, authenticating both requests to other servers and events constructed on its behalf — affecting the confidentiality, integrity, and availability of Matrix rooms with the vulnerable server as a member. The confidentiality of previous conversations in end-to-end encrypted rooms is not compromised.

Update the matrix-tools container to version 0.5.7 or later, released as part of ESS Community Helm Chart 25.12.1 (or higher, e.g., 25.12.2). If the server was already deployed with the vulnerable configuration, manual remediation should be performed according to the vendor's instructions available in the references (maintenance.md#fixing-cve-2026-24044). It is also recommended to explicitly define synapse.signingKey or set initSecrets.enabled to false in environments not covered by the update.

Element Server Suite Community Edition (ESS Community) with ESS Community Helm Chart containing matrix-tools in versions before 0.5.7, when the initSecrets.enabled parameter is not set to false and synapse.signingKey is not defined