CVE-2026-45695: Kopia: Unauthenticated Access via SSH Command Injection

Summary

Kopia's HTTP server allows unauthenticated access when started without a username or password. An attacker can inject malicious commands into the SSH connection, potentially executing arbitrary code as the Kopia process user. To mitigate this risk, start the Kopia server with a username and password, or use a more secure configuration.

What to do

Update github.com kopia to version 0.23.0.
Update kopia github.com/kopia/kopia to version 0.23.0.

Affected software

Ecosystem	Vendor	Product	Affected versions
go	github.com	kopia	<= 0.22.3 Fix: upgrade to 0.23.0
Go	kopia	github.com/kopia/kopia	< 0.23.0 Fix: upgrade to 0.23.0
–	kopia	kopia	< 0.23.0

Original title

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's H...

Original description

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand=<cmd> can cause exec.CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0.

ghsa CVSS3.1 9.8

Vulnerability type

CWE-78 OS Command Injection

CWE-306 Missing Authentication for Critical Function