# CVE-2026-45695: Kopia RCE via SSH ProxyCommand injection in HTTP API

Source: https://junglewise.ai/threats/cve-2026-45695-kopia-rce-via-ssh-proxycommand-injection-in-http-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-45695 · Severity: critical · CVSS 9.8 · Published 2026-07-16

Kopia is a backup tool used to secure and manage data across various operating systems. A security flaw in its web-based management interface allows an unauthenticated attacker to execute arbitrary commands on the host system. This could lead to a total system takeover, data theft, or the destruction of backups. The vulnerability is particularly dangerous when the server is configured to run without a password and is accessible over a network.

Technologies: [github.com/kopia/kopia (Go)](https://junglewise.ai/threats/technologies/github-com-kopia-kopia). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-45695 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45695 being exploited in the wild.

**How severe is CVE-2026-45695?** Critical severity, with a CVSS score of 9.8, published 16 July 2026.

**Which products and versions are affected?** github.com/kopia/kopia (Go) <= 0.22.3, SEMVER:introduced=0,fixed=0.23.0; Kopia <= 0.22.3.

**Is there a fix for CVE-2026-45695?** Yes. github.com/kopia/kopia (Go): upgrade to 0.23.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45695 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45695?** Check whether you run github.com/kopia/kopia (Go) or Kopia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/kopia/kopia (Go): upgrade to 0.23.0 or later

  ```sh
  go get github.com/kopia/kopia@v0.23.0
  ```


## Technical details

A remote code execution (RCE) vulnerability exists in Kopia's HTTP server due to missing authentication and improper input validation. When started with the '--without-password' flag, the server allows unauthenticated access to the '/api/v1/repo/exists' endpoint. An attacker can submit a crafted JSON request containing an SFTP storage configuration with 'externalSSH: true' and malicious 'sshArguments'. Specifically, by injecting '-oProxyCommand=<cmd>', the attacker leverages OpenSSH's behavior to execute arbitrary shell commands via 'exec.CommandContext'. This occurs because the application splits arguments only on spaces without proper sanitization or shell-style tokenization. The issue is fixed in version 0.23.0, which restricts unauthenticated servers to loopback interfaces by default.

## Affected products

- Kopia Kopia <= 0.22.3

## Identifiers

- CVE-2026-45695
- GHSA-2q4c-3mrw-63c3
- GO-2026-5009

## Timeline

- 2026-05-05: patched: Initial fix commit and pull request submitted
- 2026-05-12: other: Version 0.23.0 released
- 2026-05-13: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD

## References

- [https://github.com/kopia/kopia/commit/c26c6a1b9734c5089217986ffa5cd19f8a6b8900](https://github.com/kopia/kopia/commit/c26c6a1b9734c5089217986ffa5cd19f8a6b8900)
- [https://github.com/kopia/kopia/pull/5354](https://github.com/kopia/kopia/pull/5354)
- [https://github.com/kopia/kopia/releases/tag/v0.23.0](https://github.com/kopia/kopia/releases/tag/v0.23.0)
- [https://github.com/kopia/kopia/security/advisories/GHSA-2q4c-3mrw-63c3](https://github.com/kopia/kopia/security/advisories/GHSA-2q4c-3mrw-63c3)

## Related threats

- [Kopia path traversal in copyDirectoryContent during restore](https://junglewise.ai/threats/cve-2026-124029-kopia-through-0-23-1-contains-a-path-traversal-vulnerability-in)
- [GO-2024-2703 - Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON…](https://junglewise.ai/threats/go-2024-2703-kopia-storage-connection-credentials-written-to-console-on-35f6d502)
- [Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output](https://junglewise.ai/threats/kopia-storage-connection-credentials-written-to-console-on-repository-58ba79d8)