Is CVE-2026-45695 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45695 being exploited in the wild.

How severe is CVE-2026-45695?

Critical severity, with a CVSS score of 9.8, published 16 July 2026.

Which products and versions are affected?

github.com/kopia/kopia (Go) <= 0.22.3, SEMVER:introduced=0,fixed=0.23.0; Kopia <= 0.22.3.

Is there a fix for CVE-2026-45695?

Yes. github.com/kopia/kopia (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45695 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-45695?

Check whether you run github.com/kopia/kopia (Go) or Kopia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45695: Kopia RCE via SSH ProxyCommand injection in HTTP API

Q: Is there a fix for CVE-2026-45695?

Yes. github.com/kopia/kopia (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45695 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-45695?

Check whether you run github.com/kopia/kopia (Go) or Kopia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45695 · Severity: critical · CVSS 9.8 · Published 2026-07-16

Kopia is a backup tool used to secure and manage data across various operating systems. A security flaw in its web-based management interface allows an unauthenticated attacker to execute arbitrary commands on the host system. This could lead to a total system takeover, data theft, or the destruction of backups. The vulnerability is particularly dangerous when the server is configured to run without a password and is accessible over a network.

Technologies: github.com/kopia/kopia (Go). Vendors: Go.

Quick answers

Is CVE-2026-45695 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45695 being exploited in the wild.
How severe is CVE-2026-45695?: Critical severity, with a CVSS score of 9.8, published 16 July 2026.
Which products and versions are affected?: github.com/kopia/kopia (Go) <= 0.22.3, SEMVER:introduced=0,fixed=0.23.0; Kopia <= 0.22.3.
Is there a fix for CVE-2026-45695?: Yes. github.com/kopia/kopia (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45695 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-45695?: Check whether you run github.com/kopia/kopia (Go) or Kopia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/kopia/kopia (Go): upgrade to 0.23.0 or later
```
go get github.com/kopia/kopia@v0.23.0
```

Technical details

A remote code execution (RCE) vulnerability exists in Kopia's HTTP server due to missing authentication and improper input validation. When started with the '--without-password' flag, the server allows unauthenticated access to the '/api/v1/repo/exists' endpoint. An attacker can submit a crafted JSON request containing an SFTP storage configuration with 'externalSSH: true' and malicious 'sshArguments'. Specifically, by injecting '-oProxyCommand=<cmd>', the attacker leverages OpenSSH's behavior to execute arbitrary shell commands via 'exec.CommandContext'. This occurs because the application splits arguments only on spaces without proper sanitization or shell-style tokenization. The issue is fixed in version 0.23.0, which restricts unauthenticated servers to loopback interfaces by default.

Affected products

Kopia Kopia <= 0.22.3

Identifiers

CVE-2026-45695
GHSA-2q4c-3mrw-63c3
GO-2026-5009

Timeline

2026-05-05: patched: Initial fix commit and pull request submitted
2026-05-12: other: Version 0.23.0 released
2026-05-13: advisory: GitHub Security Advisory published
2026-07-16: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.