CVE-2026-45695
CVE-2026-45695: 1 tracked advisory record across Red Hat. Compare source-reported impact, fixes and remediation.
Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.
Vendor advisory comparison
Red Hat
1 advisory- Advisory severityMedium6.5
Medium [CVE-2026-45695] Arbitrary code execution via unauthenticated SFTP configuration in HTTP server.
CVE-2026-45695Source published Source updated
Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob. NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand= can cause exec. CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0. This allows the attacker to forward malicious SFTP storage configurations, which can lead to arbitrary code execution through OpenSSH commands. Red Hat Product Security considers this bug as Moderate as this requires active change of out…
- Affected products in this advisory
- Migration Toolkit for Containers
- OpenShift API for Data Protection
- Source-reported affected versions
- < 0.23.0
- Source-reported fixed versions
- 0.23.0
- Mitigation guidance
- This bug can be rendered unusable by making sure that --without-password is not included in startup options for Kopia HTTP server.
Android app · Google Play
Monitor future Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.