Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-45695— Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used

Quick assessment

Affected
kopia kopia
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kopia Kopia是Kopia公司开源的一款备份和恢复工具。 Kopia 0.23.0之前版本存在安全漏洞，该漏洞源于HTTP服务器在无密码模式下接受未经过身份验证的请求并转发SFTP存储配置，可能导致通过OpenSSH执行任意命令。

CVSS 9.8 · Critical EPSS 1.61% · P75

Public Exploits 1

Nuclei · 1 CVE-2026-45695.yaml [template]

Affected Version Matrix 1

VendorProduct Version RangeStatus
kopia kopia < 0.23.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-45695

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used
Source: CVE Program / CVE List V5
Vulnerability Description
Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand=<cmd> can cause exec.CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Kopia 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Kopia Kopia是Kopia公司开源的一款备份和恢复工具。 Kopia 0.23.0之前版本存在安全漏洞，该漏洞源于HTTP服务器在无密码模式下接受未经过身份验证的请求并转发SFTP存储配置，可能导致通过OpenSSH执行任意命令。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
kopia kopia < 0.23.0 -

II. Public POCs for CVE-2026-45695

# POC Description Source Link Shenlong Link
1 Kopia before version 0.23.0 allows unauthenticated remote code execution when started in server mode with the --without-password flag. When the /api/v1/repo/exists endpoint is exposed, it enables instantiation of the SFTP storage backend with user-supplied sshArguments. Due to improper argument parsing, an attacker may inject arbitrary SSH options such as -oProxyCommand, resulting in execution of arbitrary commands as the server process. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-45695.yaml POC Details
AI-Generated POC Premium
Qwen3.6-35B-A3B · 7259 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-45695

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-45695 (2)

Vendor Advisories for CVE-2026-45695 (1)

Vendor Pages for CVE-2026-45695 (1)

IV. Related Vulnerabilities

Same weakness: CWE-78

V. Comments for CVE-2026-45695

No comments yet

Leave a comment