CVE-2026-45695
Received Received - Intake

Remote Code Execution in Kopia Backup Tool

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: GitHub, Inc.

Description
Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand=<cmd> can cause exec.CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-07-16
AI Q&A
2026-07-16
EPSS Evaluated
N/A
NVD
CVE-2026-45695
EUVD
EUVD-2026-44948

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
kopia kopia to 0.23.0 (exc)
kopia kopia 0.22.3
kopia kopia 0.23.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-45695 is a critical remote code execution (RCE) vulnerability in Kopia, a backup tool. It affects versions 0.22.3 and earlier. When Kopia's HTTP server runs without authentication (using --without-password), unauthenticated requests can reach /api/v1/repo/exists. Attackers can send malicious storage configs with SSH ProxyCommand options to execute arbitrary commands via OpenSSH.

Detection Guidance

Check if Kopia is running with the --without-password flag and bound to a non-loopback address. Inspect network connections with commands like 'ss -tulnp | grep kopia' or 'netstat -tulnp | grep kopia' to identify exposed HTTP servers. Review Kopia logs for unauthenticated access attempts to /api/v1/repo/exists endpoints.

Impact Analysis

This vulnerability allows attackers to execute arbitrary commands on the system running the vulnerable Kopia instance. Since no authentication or user interaction is required, attackers can gain full control over the host, leading to data theft, system compromise, or disruption of backup operations. The impact includes high confidentiality, integrity, and availability losses.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and system integrity. GDPR requires safeguarding personal data, and HIPAA mandates protecting health information. Exploitation could lead to unauthorized access, data breaches, or loss of data integrity, resulting in regulatory penalties, fines, or legal consequences.

Mitigation Strategies

Upgrade Kopia to version 0.23.0 or later immediately. If upgrading is not possible, ensure the HTTP server is bound only to loopback addresses (127.0.0.1) and disable the --without-password flag. Remove any exposed unauthenticated endpoints and restrict network access to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart