Kopia Backup suffers critical unauthenticated RCE through SSH ProxyCommand injection (CVE‑2026‑45695)
Researchers discovered CVE‑2026‑45695, a critical 9.8‑scored flaw in Kopia’s /api/v1/repo/exists endpoint that forwards SFTP settings directly to the SSH binary, enabling unauthenticated remote code execution via ProxyCommand injection. The bug affects Kopia versions ≤0.22.3 when run without password protection on network‑exposed interfaces. Updating to 0.23.0 or restricting the server to localhost mitigates the risk.