CVE-2026-45695

creationtimestamp| type| source ---|---|--- 2026-07-16 16:42:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrojgm4yj2p...

CVE-2026-45695

Kopia prior to version 0.23.0 is vulnerable to unauthenticated remote command execution via SSH ProxyCommand Injection when the HTTP server runs with --without-password. An attacker can send requests to /api/v1/repo/exists, causing the server to forward attacker-supplied SFTP storage configuratio...