Vulnerability · Published Jul 16, 2026 · Assigned by GitHub_M

CVE-2026-45695Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used

Critical 9.8

In plain English

A critical-severity OS command injection in kopia from kopia. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.6% (higher than 76% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.6%top 24.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand=<cmd> can cause exec.CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/kopia/kopia	0.23.0	GHSA-2q4c-3mrw-63c3
Go	github.com/kopia/kopia	0.23.0	GO-2026-5009

Affected products (as reported)

Vendor	Product	Versions
kopia	kopia	< 0.23.0

Weakness: CWE-78, CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://github.com/kopia/kopia/security/advisories/GHSA-2q4c-3mrw-63c3 x_refsource_CONFIRM
https://github.com/kopia/kopia/pull/5354 x_refsource_MISC
https://github.com/kopia/kopia/commit/c26c6a1b9734c5089217986ffa5cd19f8a6b8900 x_refsource_MISC
https://github.com/kopia/kopia/releases/tag/v0.23.0 x_refsource_MISC