What is the CVSS score of CVE-2026-45695?

CVE-2026-45695 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Kopia are affected by CVE-2026-45695?

Kopia backup server (versions ≤0.22.3) can be exploited by remote attackers to execute commands and take control of backup infrastructure without any authentication.. A patch is available.

How to fix or mitigate CVE-2026-45695?

Exploitation: Publicly available exploit code exists; unauthenticated attackers can execute arbitrary OS commands on affected systems. Within 24 hours: 1. Audit all Kopia backup server instances to identify versions ≤0.22.3, particularly those using the --without-password flag 2. Isolate vulnerable systems from network access until patching is complete 3. Preserve all access logs and audit trails for forensic investigation 4. Screen backup repositories for unauthorized access or modifications since deployment Within 7 days: 1. Upgrade all affected Kopia servers to the latest patched version per vendor advisory 2. Verify successful upgrades and restore monitored network access 3. Conduct access log forensics to identify any compromise indicators Within 30 days: 1. Complete security assessment of entire backup infrastructure 2. Require authentication on all Kopia instances; disable --without-password flag 3. Implement network segmentation isolating backup systems from general networks 4. Deploy continuous monitoring and alerting for suspicious backup access patterns

Kopia CVE-2026-45695

CRITICAL

OS Command Injection (CWE-78)

2026-05-19 https://github.com/kopia/kopia

GHSA-2q4c-3mrw-63c3

SSH Command Injection Suse

9.8

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

May 19, 2026 - 20:00 vuln.today

Analysis Generated

May 19, 2026 - 20:00 vuln.today

DescriptionGitHub Advisory

Summary

Kopia's HTTP server, when started with --without-password , accepts unauthenticated requests to /api/v1/repo/exists. The handler forwards an attacker-supplied storage configuration to blob.NewStorage. For SFTP backends with externalSSH: true, that path constructs a process command line by splitting sshArguments on spaces and passes the result directly to exec.CommandContext("ssh"). An -oProxyCommand=<cmd> token in sshArguments causes OpenSSH to invoke <cmd> via $SHELL -c before any TCP connection is attempted, giving the requester arbitrary command execution as the Kopia process user.

Analysis

internal/server/server_authz_checks.go lines 61-73:

when the server is started without --server-username or --server-password, getAuthenticator() returns nil and requireUIUser unconditionally authorizes the request. Every endpoint registered through handleUIPossiblyNotConnected becomes accessible without credentials.

repo/blob/sftp/sftp_storage.go lines 448-468:

opt.SSHArguments is populated from the JSON request body (storage.config.sshArguments). The string is split only on the literal ASCII space character, there is no shell style tokenizer, no quote handling, and no allowlist. Whatever tokens the caller supplies are appended to the ssh argv.

OpenSSH treats -oProxyCommand=<value> as a directive to execute <value> via the user's shell ($SHELL -c <value>) and pipe the SSH transport over its stdio. The shell invocation happens before SSH attempts a TCP connection, so the command runs even when the target host is unreachable.

Impact

No user interaction is required. No valid credentials are required. The exploit is a single HTTP request.

Credits

This vulnerability was discovered and responsibly disclosed by Daniele Berardinelli.

Mitigation

https://github.com/kopia/kopia/pull/5354 disallows starting of a server without a password which also listens on a non-loopback interface.

AnalysisAI

Remote code execution in Kopia backup server (≤ 0.22.3) allows unauthenticated attackers to run arbitrary OS commands as the Kopia process user via a single HTTP request to /api/v1/repo/exists when the server is launched with --without-password. Publicly available exploit code exists through the published GHSA advisory and PR diff; no public exploit identified at time of analysis as being weaponized in the wild, but the trivially exploitable vector (CVSS 9.8) and detailed write-up make weaponization straightforward. The bug stems from naive space-splitting of attacker-controlled sshArguments that is fed to exec.CommandContext("ssh"), letting an -oProxyCommand= token trigger $SHELL -c execution before any SSH transport is established.

Technical ContextAI

Kopia is an open-source, cross-platform backup tool written in Go (pkg:go/github.com_kopia_kopia) that exposes an HTTP control/UI API. Two code paths combine to produce this flaw: internal/server/server_authz_checks.go (lines 61-73) returns a nil authenticator when --server-username/--server-password are absent, causing requireUIUser to unconditionally authorize every UI endpoint registered via handleUIPossiblyNotConnected; and repo/blob/sftp/sftp_storage.go (lines 448-468) tokenizes attacker-supplied SSHArguments by splitting on the literal ASCII space and appends the tokens directly to the ssh argv via os/exec, with no shell tokenizer, quote handling, or allowlist. The root cause is classic CWE-78 (OS Command Injection): OpenSSH's -oProxyCommand directive intentionally hands its value to $SHELL -c before opening any TCP connection, turning untrusted ssh arguments into a shell-execution primitive even when the target host is unreachable.

RemediationAI

Vendor-released patch: upgrade to Kopia 0.23.0 or later, which introduces the insecureserverbind package and refuses to bind an unauthenticated server (--without-password combined with --insecure) to any non-loopback address unless the operator explicitly passes the new --allow-extremely-dangerous-unauthenticated-server-on-the-network flag (see https://github.com/kopia/kopia/pull/5354 and the advisory at https://github.com/kopia/kopia/security/advisories/GHSA-2q4c-3mrw-63c3). If upgrading immediately is not possible, the recommended workarounds are to always start kopia server with --server-username and --server-password (or TLS client certificates) so getAuthenticator() returns a real authenticator, restrict the listen address to 127.0.0.1 or a Unix domain socket and front it with an authenticated reverse proxy, and add a host-based firewall rule blocking inbound access to the Kopia HTTP port from anything except trusted management hosts; the trade-off is that loopback-only binding breaks remote browser access until a proxy is configured. Operators should also audit logs for unexpected requests to /api/v1/repo/exists carrying storage.config.sshArguments containing -oProxyCommand.