CVE-2026-24044

The record

Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution. The ESS Community Helm Chart secrets initialization hook (using matrix-tools container before 0.5.7) is using an insecure Matrix server key generation method, allowing network attackers to potentially recreate the same key pair, allowing them to impersonate the victim server. The secret is generated by the secrets initialization hook, in the ESS Community Helm Chart values, if both initSecrets.enabled is not set to false and synapse.signingKey is not defined. Given a server key in Matrix authenticates both requests originating from and events constructed on a given server, this potentially impacts confidentiality, integrity and availability of rooms which have a vulnerable server present as a member. The confidentiality of past conversations in end-to-end encrypted rooms is not impacted. The key generation issue was fixed in matrix-tools 0.5.7, released as part of ESS Community Helm Chart 25.12.1.

Affected packages

Related vulnerabilities

• CVE-2026-45078 Synapse is an open source Matrix homeserver implementation. Also affects matrix-synapse
• CVE-2026-45076 Synapse is an open source Matrix homeserver implementation. Also affects matrix-synapse
• CVE-2024-53867 Synapse is an open-source Matrix homeserver. Also affects matrix-synapse
• CVE-2024-37302 Synapse denial of service through media disk space consumption Also affects matrix-synapse
• CVE-2024-37303 Synapse's unauthenticated writes to the media repository allow planting of problematic… Also affects matrix-synapse
• CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external… Also affects matrix-synapse
• CVE-2024-52805 Synapse allows unsupported content types to lead to memory exhaustion Also affects matrix-synapse
• CVE-2024-52815 Synapse allows a a malformed invite to break the invitee's `/sync` Also affects matrix-synapse