# Fireblocks mpc-lib flaw breaks key isolation

Published: 2026-10-26 · Severity: routine · Sectors: Financial Services, Technology
Canonical: https://vorant.io/reports/dcbee9c2-822d-5f84-b104-59d154b0da61/fireblocks-mpc-lib-flaw-breaks-key-isolation

> A fail-open bug in Fireblocks' mpc-lib hardened derivation lets attackers recover ancestor key shares from a compromised descendant share, with no vendor fix yet.

CERT/CC published VU#701544 describing CVE-2026-90975, a cryptographic fail-open vulnerability in Fireblocks' mpc-lib library, which underpins MPC-based custody of cryptocurrency private keys for institutions and exchanges. The flaw lies in the BIP32 hardened derivation implementation: when a parent private key is missing, the code substitutes a null buffer instead of rejecting the operation. Since the buffer becomes a known constant, the derivation delta becomes publicly computable, violating the ancestor isolation property that hardened derivation is supposed to guarantee.

The practical impact is that an attacker who compromises a single MPC party's lower-level (descendant) signer share, and who also knows the associated chain code, can compute the derivation delta and subtract it to recover that party's higher-level ancestor share, repeating the process up the hierarchy to obtain that party's root share. This does not by itself yield a spendable private key, since the MPC secret-sharing layer still requires a threshold of parties to reconstruct a key. However, it silently removes a defense-in-depth layer: compromise of one share can cascade across a party's entire derivation hierarchy over time with no logging or error indication. The precondition is trivially met in deployments that treat the chain code as public, as is common in BIP32 usage (e.g., exposed via watch-only extended public keys).

At time of publication, Fireblocks could not be reached by CERT/CC to coordinate disclosure, and no vendor patch is available. CERT/CC recommends integrators treat chain codes as secret rather than public, avoiding their exposure in watch-only extended public keys or to untrusted parties, which prevents the delta from being publicly computable. Additionally, organizations should not rely on hardened derivation alone for isolation between signer shares and should audit derivation paths for hardened segments, treating any single share compromise as a potential exposure path to that party's other shares. A complete fix requires a library code change. No in-the-wild exploitation has been reported; this is a disclosed cryptographic design flaw rather than an active campaign.

## Mentioned in this report

- Vulnerabilities: CVE-2026-90975

Source reporting: https://kb.cert.org/vuls/id/701544

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/dcbee9c2-822d-5f84-b104-59d154b0da61/fireblocks-mpc-lib-flaw-breaks-key-isolation.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup