CVE-2026-45695 Security Alert: CRITICAL Vulnerability

Urgent: CVE-2026-45695 requires immediate attention.

· 7 min read

Executive Summary

CVE-2026-45695 is a critical remote code execution issue in Kopia affecting versions prior to 0.23.0. The problem is in Kopia’s HTTP server when started with --without-password: unauthenticated requests to /api/v1/repo/exists can pass attacker-controlled SFTP settings into blob.NewStorage. With externalSSH: true and a crafted sshArguments value such as -oProxyCommand=<cmd>, OpenSSH may invoke the attacker’s command via exec.CommandContext("ssh").

Bottom line: if you run Kopia as a service, exposed HTTP endpoint, container, or backup appliance, treat this as an urgent patch-and-isolate event. Even though there is no known exploitation in the wild and it is not in CISA KEV, the severity is CVSS 9.8 and the attack path is straightforward if the server is reachable.

Immediate Action

  • Upgrade Kopia immediately to 0.23.0 or later. If you cannot patch right away, take the service offline or block network access to the HTTP server.
  • Disable any deployment using --without-password until patched. If that mode is required, restrict access to localhost or a trusted management network only.
  • Remove exposure at the edge: firewall or reverse-proxy block access to /api/v1/repo/exists from untrusted clients.
  • Audit for suspicious SSH command execution on hosts running Kopia, especially child processes spawned by the Kopia service account.
  • Rotate secrets and credentials used by backup repositories if the service was reachable from untrusted networks.
  • See the vendor advisory / release notes: Kopia security advisory (TODO).

Affected Versions

  • kopia<0.23.0 vulnerable; upgrade to 0.23.0 or later.
  • kopia@0.23.0+ safe, based on the fix described in the release notes.
  • Highest risk: deployments running the HTTP server with --without-password and reachable from any untrusted network.

Resolution Guide

Important: Kopia is not typically installed via npm, pip, Maven, or Gradle. Those commands below are included only as ecosystem placeholders for teams that mirror the binary in package workflows. Use the native install method for your platform whenever possible.

Linux package/binary update:

# TODO: replace with your distro/package source if available
# Example: download and install Kopia 0.23.0+
sudo systemctl stop kopia-server 2>/dev/null || true
# Replace with your actual upgrade command or package manager step
# e.g. sudo apt-get install --only-upgrade kopia
# e.g. sudo yum update kopia
sudo systemctl start kopia-server 2>/dev/null || true

Docker:

# Pin to a fixed safe version
docker pull kopia/kopia:0.23.0
docker run --rm kopia/kopia:0.23.0 --version

JavaScript / Python / Java placeholders for mirrored deployments:

# npm / yarn / pnpm (placeholder if your org wraps Kopia in a toolchain)
npm i TODO_PACKAGE@0.23.0
yarn add TODO_PACKAGE@0.23.0
pnpm add TODO_PACKAGE@0.23.0

# pip / pipx (placeholder)
pip install TODO_PACKAGE==0.23.0
pipx upgrade TODO_PACKAGE

# Maven / Gradle (placeholder)
# Maven
mvn versions:use-dep-version -Dincludes=TODO_GROUP:TODO_ARTIFACT -DdepVersion=0.23.0
# Gradle
./gradlew dependencies --refresh-dependencies

Config hardening:

# Prefer localhost-only binding if the UI/API is not meant for remote access
kopia server start --address=127.0.0.1:51515

# Avoid unauthenticated mode
# DO NOT use:
# kopia server start --without-password

# If you must keep the service online before patching, restrict access at the firewall:
sudo ufw deny 51515/tcp
# or only allow trusted admin IPs
sudo ufw allow from 10.0.0.0/8 to any port 51515 proto tcp

Minimal code/config fix example: if you maintain a wrapper or automation around Kopia, block unauthenticated repo-exists checks until the upgrade is complete:

// Pseudocode: reject unauthenticated access to repo existence checks
if req.URL.Path == "/api/v1/repo/exists" && !isAuthenticated(req) {
    http.Error(w, "forbidden", http.StatusForbidden)
    return
}

Detection & Verification

Check your installed version:

kopia --version
kopia server --version 2>/dev/null || true

Find risky startup flags:

ps aux | grep -E 'kopia.*--without-password|kopia server' | grep -v grep
systemctl cat kopia-server 2>/dev/null | sed -n '1,200p'
grep -R --line-number -- '--without-password' /etc/systemd /etc/default /opt 2>/dev/null

Look for exposed endpoints:

curl -i http://127.0.0.1:51515/api/v1/repo/exists
# If the service is remote, confirm it is not reachable from untrusted networks.

Verify the fix:

# Confirm the version is at least 0.23.0
kopia --version

# Confirm the service no longer accepts unauthenticated access from untrusted clients
curl -i http://127.0.0.1:51515/api/v1/repo/exists
# Expect denied/forbidden behavior unless explicitly authenticated and intended.

Dependency and image checks:

# Container images
docker image ls | grep -i kopia
docker inspect kopia/kopia:0.23.0 --format '{{.RepoTags}}'

# SBOM / inventory scanners
grype kopia/kopia:0.23.0
trivy image kopia/kopia:0.23.0

Risk and Impact

This flaw can let a remote attacker trigger command execution on the host running Kopia, potentially with the privileges of the backup service account. In a small-team environment, that can mean theft of backup credentials, tampering with backup data, lateral movement to other systems, or destruction of recovery points. If the Kopia server has access to production storage, the blast radius can extend well beyond the backup host itself.

Action for solo developers and small teams: patch first, then lock down exposure. If the service is internet-facing or shared across a team, assume it is high risk until you have upgraded to 0.23.0+ and verified the endpoint is no longer reachable by untrusted users.

Keep reading