CVE-2026-45695 — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-45695/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 19 May 2026 19:20:30 +0000Kopia RCE via SSH ProxyCommand Injection (CVE-2026-45695)https://feed.craftedsignal.io/briefs/2026-05-kopia-rce/Tue, 19 May 2026 19:20:30 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-kopia-rce/Kopia's HTTP server, when started without `--without-password`, accepts unauthenticated requests which can lead to arbitrary command execution as the Kopia process user via `-oProxyCommand` in `sshArguments` for SFTP backends with `externalSSH: true`. An attacker-supplied storage configuration is forwarded to `blob.NewStorage`, and the `sshArguments` are split on spaces and passed directly to `exec.CommandContext("ssh")`, resulting in command injection.Kopia is vulnerable to remote command execution (CVE-2026-45695) when its HTTP server is started without authentication (--without-password) and configured to use an SFTP backend with externalSSH: true. This configuration flaw allows unauthenticated attackers to send a crafted HTTP request to the /api/v1/repo/exists endpoint. The vulnerability stems from the lack of proper input validation of sshArguments within the SFTP storage configuration. An attacker can inject arbitrary commands by including -oProxyCommand=<cmd> in the sshArguments. This leads to command execution as the Kopia process user due to how OpenSSH handles the ProxyCommand option. This issue affects Kopia versions 0.22.3 and earlier.

Attack Chain

  1. Kopia HTTP server is started without authentication using the --without-password flag.
  2. The server is configured to use an SFTP backend with externalSSH: true.
  3. Attacker sends an unauthenticated HTTP POST request to the /api/v1/repo/exists endpoint.
  4. The request contains a crafted JSON body with malicious sshArguments including -oProxyCommand=<malicious_command>.
  5. The server’s handleUIPossiblyNotConnected function authorizes the request due to the missing authentication.
  6. The blob.NewStorage function processes the attacker-supplied storage configuration.
  7. Within the SFTP backend logic, opt.SSHArguments are populated from the JSON request body.
  8. The sshArguments string is split on spaces and passed directly to exec.CommandContext("ssh", ...) without proper sanitization.
  9. OpenSSH executes the injected command via $SHELL -c <malicious_command> before any TCP connection is attempted.
  10. The attacker achieves arbitrary command execution as the Kopia process user.

Impact

Successful exploitation of CVE-2026-45695 allows unauthenticated attackers to execute arbitrary commands on the Kopia server. There is no need for user interaction or valid credentials. The attacker gains the privileges of the Kopia process user, potentially leading to complete system compromise. The impact includes data exfiltration, system disruption, or further lateral movement within the network.

Recommendation

  • Upgrade to Kopia version 0.22.4 or later, which includes the fix described in https://github.com/kopia/kopia/pull/5354. This disables starting a server without a password that also listens on a non-loopback interface.
  • If upgrading is not immediately feasible, ensure that the Kopia HTTP server is never started without authentication (--server-username or --server-password).
  • Deploy the Sigma rules provided in this brief to your SIEM to detect potential exploitation attempts of CVE-2026-45695.
  • Monitor web server logs for suspicious POST requests to the /api/v1/repo/exists endpoint with unusual sshArguments in the request body.
]]>criticaladvisoryrcevulnerabilitycommand-injectionkopiaCVE-2026-45695