CVE-2026-73230

Received Received - Intake

Ente 2of3 Card Format Secret Length and Checksum Exposure

Publication date: 2026-08-11

Last updated on: 2026-08-13

Assigner: GitHub, Inc.

Description

Ente provides end-to-end encrypted cloud services and security tools. Prior to 2026.07.28, Ente 2of3 card format version 1 stored the secret byte length and 32-bit FNV-1a checksum in cleartext on every card, allowing someone with one card to test candidate secrets offline and recover low-entropy or predictable secrets. This issue is fixed in version 2026.07.28.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-11

Last Modified

2026-08-13

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-73230

EUVD

EUVD-2026-56893

Affected Vendors & Products

Vendor	Product	Version / Range
ente	ente	2026.07.28

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

CVE-2026-73230 affects Ente's 2of3 secret-sharing system before version 2026.07.28. Version 1 cards stored the secret byte length and checksum in plaintext, allowing attackers with one card to test guesses offline and recover weak secrets.

Detection Guidance

To detect this vulnerability, check if your Ente application is running a version prior to 2026.07.28. On Linux or macOS, run: ente --version. If the version is older, the system is vulnerable. Additionally, inspect any 2of3 recovery cards for plaintext secret byte length and checksum storage.

Impact Analysis

If you used version 1 cards and your secret was guessable, an attacker with one card could brute-force and recover it. Upgrade to version 2 cards and rotate secrets if exposed. Older recovery tools won't work with version 2 cards.

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by exposing sensitive information through plaintext storage of secret byte length and checksums. Unauthorized access to low-entropy secrets via offline brute-force attacks may lead to unauthorized data exposure, violating confidentiality requirements under these regulations.

Mitigation Strategies

Update Ente to version 2026.07.28 or later. Replace all version 1 2of3 recovery cards with version 2 cards. If version 1 cards were exposed and the secret is guessable, rotate the secret immediately. Ensure recovery tools are updated to support version 2 cards.

Hi! I’m here to help you understand CVE-2026-73230. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70