TLDR Tech / InfoSec
Critical Unauthenticated RCE in Kopia Backup via SSH ProxyCommand Injection
Orca Security has disclosed CVE-2026-45695 (CVSS 9.8), an unauthenticated remote code execution flaw in the Kopia open-source backup tool where the /api/v1/repo/exists endpoint passes SFTP storage configuration fields directly into an SSH command line without tokenization or quote handling, letting an attacker inject -oProxyCommand= tokens in a single crafted HTTP request to force OpenSSH to run arbitrary shell commands. The bug affects Kopia HTTP server versions 0.22.3 and earlier when the server runs with --without-password and binds to non-loopback interfaces with an SFTP external-SSH backend. Although researcher Daniele Berardinelli disclosed it responsibly, with no public proof-of-concept yet, the single-request attack vector makes weaponization trivial and risks full backup data exfiltration and infrastructure pivoting. Administrators should upgrade to version 0.23.0 or later immediately, and otherwise bind Kopia to localhost only and place any externally reachable instance behind an authenticating reverse proxy.
Read the full story