Loading story…
A critical remote code execution flaw tracked as CVE-2026-45695 affects Kopia Server versions up to 0.22.3, allowing unauthenticated attackers to execute commands through the POST /api/v1/repo/exists endpoint under specific configurations. The issue arises when Kopia is run with --without-password and uses an SFTP backend with externalSSH, letting attacker-controlled sshArguments be split on spaces and passed to SSH. By injecting -oProxyCommand, an attacker can cause SSH to invoke /bin/sh before a connection is established, leading to command execution with the privileges of the Kopia server process.
Public exploitation details and detection content were released alongside a Metasploit exploit module and a Nuclei template update, indicating rapid weaponization of the bug. Reported proof-of-concept testing against kopia/kopia:0.22.3 showed both timing-based validation and reverse-shell execution, while 0.23.0 is described as fixed or otherwise protected by refusing unauthenticated exposure on non-loopback interfaces. The vulnerability specifically impacts deployments that expose the affected endpoint without authentication and permit external SSH options in repository checks.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
A Rapid7 Metasploit Framework pull request added an exploit module for the Kopia Server SFTP ProxyCommand argument injection vulnerability, indicating public weaponization of the issue. The module targets unauthenticated command execution through the vulnerable /api/v1/repo/exists endpoint.
A ProjectDiscovery nuclei-templates pull request added detection content for CVE-2026-45695, documenting the vulnerable behavior and a timing-based exploitation check using a malicious SSH ProxyCommand argument. This reflects public technical detection guidance for the Kopia Server issue.
The references state that version 0.23.0 is the fixed or non-vulnerable release for CVE-2026-45695. One report notes that kopia/kopia:0.23.0 refuses unauthenticated exposure on non-loopback interfaces, preventing the demonstrated attack path.
Proof-of-concept exploitation was demonstrated against the kopia/kopia:0.22.3 container image, including timing-based command execution via a malicious -oProxyCommand value and a reverse shell demonstration. The reports indicate successful command execution through /bin/sh before SSH connection establishment.
A command injection vulnerability tracked as CVE-2026-45695 was identified in Kopia Server's POST /api/v1/repo/exists endpoint when using external SSH options, allowing attacker-controlled sshArguments to inject an SSH ProxyCommand and achieve unauthenticated remote code execution. The issue was reported as affecting versions up to 0.22.3, particularly when the server was exposed without password protection.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Kopia disclosed **CVE-2026-45695**, a critical unauthenticated remote code execution flaw affecting versions before `0.23.0`. The bug can be triggered when the backup tool's HTTP server is started with `--without-password`, allowing unauthenticated requests to `/api/v1/repo/exists` to pass attacker-controlled SFTP settings into backend storage handling. If `externalSSH` is enabled and `sshArguments` includes a malicious `-oProxyCommand` value, Kopia can invoke `ssh` in a way that leads to arbitrary command execution on the host. The issue carries a **CVSS 9.8** rating and can expose confidentiality, integrity, and availability to full compromise. The project fixed the vulnerability in version `0.23.0` and also added safeguards to prevent insecure unauthenticated servers from being exposed on non-loopback interfaces by default. A related code change restricts use of `--insecure` together with `--without-password` to loopback addresses or Unix sockets unless operators explicitly set the hidden override flag `--allow-extremely-dangerous-unauthenticated-server-on-the-network`, which warns that remote attackers could gain full control of the server host. Maintainers advised users to upgrade and ensure the HTTP server is protected with a password rather than exposed unauthenticated on the network.
Jul 17, 2026
A high-severity flaw tracked as **CVE-2026-15416** allows unauthenticated remote code execution in **Argo CD** by abusing the repo-server's `GenerateManifest` gRPC endpoint. According to Red Hat and related disclosures, an attacker with network access to the repo-server interface can exploit malicious `KustomizeOptions`, including `BuildOptions` or `BinaryPath`, to run arbitrary commands inside the repo-server pod. The issue is rated **CVSS 8.9** and mapped to **CWE-306** for missing authentication on a critical function. The vulnerability can also be chained with access to the Argo CD **Redis** cache to tamper with cached data and push attacker-controlled Kubernetes manifests to Argo CD-managed environments, creating a path to full cluster compromise. Red Hat said affected products include Argo CD deployments and related OpenShift components, while **OpenShift GitOps 1.20 and 1.21** are not affected because default Kubernetes `NetworkPolicy` settings block the required access to internal repo-server and Redis services. Recommended actions include patching to a fixed version, preventing external exposure of the repo-server, restricting network access to the gRPC endpoint and Redis, and reviewing deployment configurations.
Jul 15, 2026
A GitHub repository called **"exploitarium"**, operated by the account **`bikini`**, has published a growing archive of uncoordinated zero-day proof-of-concept exploits affecting dozens of open-source and infrastructure projects before vendors could patch them. Reporting says the archive expanded beyond early public estimates to **35 project folders and 204 tracked files**, with new targets continuing to appear at a pace of roughly two to three projects per week. The exposed attack surface spans libraries, kernel drivers, remote-access tools, web applications, and core infrastructure including **PostgreSQL, Redis, Nextcloud, Discourse, Nmap, curl, AnyDesk, RustDesk, Git,** and some **PHP** builds. Researchers identified **`CVE-2026-55200`** in **libssh2** as one of the most serious issues in the archive: a pre-authentication out-of-bounds write in **`ssh2_transport_read()`** affecting libssh2 through **1.11.1**, with an upstream fix referenced as commit **`97acf3d`**. Because libssh2 is embedded transitively in widely used software such as **curl** and **Git**, the disclosures are being treated as a broader supply-chain exposure rather than a single incident. Assessments describe exploitarium as a lightly moderated multi-contributor clearinghouse that distributes unvetted exploit material at scale, prompting calls for urgent patching, software composition analysis, reachability-based remediation, and sustained monitoring.
Jul 22, 2026