Loading story…
Kopia disclosed CVE-2026-45695, a critical unauthenticated remote code execution flaw affecting versions before 0.23.0. The bug can be triggered when the backup tool's HTTP server is started with --without-password, allowing unauthenticated requests to /api/v1/repo/exists to pass attacker-controlled SFTP settings into backend storage handling. If externalSSH is enabled and sshArguments includes a malicious -oProxyCommand value, Kopia can invoke ssh in a way that leads to arbitrary command execution on the host. The issue carries a CVSS 9.8 rating and can expose confidentiality, integrity, and availability to full compromise.
The project fixed the vulnerability in version 0.23.0 and also added safeguards to prevent insecure unauthenticated servers from being exposed on non-loopback interfaces by default. A related code change restricts use of --insecure together with --without-password to loopback addresses or Unix sockets unless operators explicitly set the hidden override flag --allow-extremely-dangerous-unauthenticated-server-on-the-network, which warns that remote attackers could gain full control of the server host. Maintainers advised users to upgrade and ensure the HTTP server is protected with a password rather than exposed unauthenticated on the network.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The vulnerability record states that Kopia fixed CVE-2026-45695 in version 0.23.0. It also recommends upgrading and ensuring the HTTP server is started with a password as mitigation.
CVE-2026-45695 was disclosed as a critical unauthenticated remote code execution vulnerability in Kopia affecting versions prior to 0.23.0. The issue involves attacker-controlled SFTP configuration reaching blob.NewStorage and triggering command execution through OpenSSH ProxyCommand when externalSSH is enabled.
A Kopia code change added validation to block starting the server with both --insecure and --without-password on non-loopback network interfaces unless an explicit dangerous override flag is used. The change also added tests and warnings that remote attackers could gain full control of the host if such a server is exposed.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical remote code execution flaw tracked as **`CVE-2026-45695`** affects **Kopia Server** versions up to **`0.22.3`**, allowing unauthenticated attackers to execute commands through the **`POST /api/v1/repo/exists`** endpoint under specific configurations. The issue arises when Kopia is run with **`--without-password`** and uses an SFTP backend with **`externalSSH`**, letting attacker-controlled **`sshArguments`** be split on spaces and passed to SSH. By injecting **`-oProxyCommand`**, an attacker can cause SSH to invoke **`/bin/sh`** before a connection is established, leading to command execution with the privileges of the Kopia server process. Public exploitation details and detection content were released alongside a Metasploit exploit module and a Nuclei template update, indicating rapid weaponization of the bug. Reported proof-of-concept testing against **`kopia/kopia:0.22.3`** showed both timing-based validation and reverse-shell execution, while **`0.23.0`** is described as fixed or otherwise protected by refusing unauthenticated exposure on non-loopback interfaces. The vulnerability specifically impacts deployments that expose the affected endpoint without authentication and permit external SSH options in repository checks.
Jun 29, 2026
Dokploy disclosed and patched **CVE-2026-72878**, an OS command injection vulnerability in its backup and restore pipeline that allows an authenticated admin or owner to execute arbitrary commands on the host running the self-hosted PaaS. The flaw affects versions prior to `0.29.13` and arises from user-controlled database fields being interpolated directly into `bash` and `sh` command strings executed through `child_process.exec()`, giving attackers a path to host-level code execution rather than confinement inside application containers. The remediation in Dokploy `0.29.13` hardens multiple backup and restore paths by escaping shell arguments with the `shell-quote` library. The patch replaces unsafe interpolation across workflows involving `rclone`, `gunzip`, `unzip`, and restore operations for Compose, LibSQL, MariaDB, MongoDB, MySQL, PostgreSQL, and web server backups, while also protecting S3-related parameters including bucket paths, backup filenames, temporary directories, access keys, secret keys, region, endpoint, and provider.
Aug 11, 2026
A high-severity vulnerability tracked as **`CVE-2026-53951`** affects the **Copier** library and CLI, allowing attackers to bypass the tool’s template trust protections and trigger execution of template-defined actions without the usual `--trust` prompt. The flaw impacts versions **9.5.0 through 9.15.1** and stems from improper validation of trusted template URLs: Copier checked trust with a raw `str.startswith` comparison before normalizing the path, enabling a crafted template reference containing `..` to appear to match a trusted prefix while resolving to a different, attacker-controlled location. Successful exploitation can cause Copier to run malicious **`tasks`**, **`migrations`**, or **`jinja_extensions`**, resulting in arbitrary command execution with potential impact to confidentiality, integrity, and availability. The issue is classified under **`CWE-22`** and **`CWE-94`**, and the project has released **Copier `v9.15.2`** to fix the trust-bypass path traversal issue; the release notes identify the update as a security fix preventing trusted template URL abuse.
Jul 9, 2026