CVE-2026-45695

creationtimestamp| type| source ---|---|--- 2026-07-16 16:42:09+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mqrojgm4yj2p 2026-09-11 11:00:42+00:00| exploited| https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/7ae70118-bb20-4e14-a01c-cfb2d14d7491...

CVE-2026-45695

The Kopia backup tool (versions prior to 0.23.0 ) is vulnerable to unauthenticated remote code execution (RCE) when the HTTP server is started with the --without-password flag. An attacker can send specially crafted requests to the /api/v1/repo/exists endpoint to inject malicious SFTP storage con...