Notifications
Clear all
Topic starter
09/06/2026 11:24 pm
TL;DR: A CVE-2026-45695 flaw in Kopia allows unauthenticated remote code execution through SSH argument injection when the server runs in passwordless mode and exposes an SFTP backend, according to Orca Security. Backup infrastructure that assumes internal reachability is enough to justify weak authentication now needs a stricter identity and exposure model.
NHIMG editorial — based on content published by Orca Security covering the Kopia vulnerability: unauthenticated remote code execution through SSH argument injection
By the numbers:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
A: The trust boundary breaks first, then the service becomes a remote code execution path.
Q: Why do backup tools create high-impact exposure when they are reachable from the network?
A: Backup tools often hold broad storage and restore permissions, so their effective authority is larger than their user interface suggests.
Q: How do security teams know whether a backup service is operating outside its intended boundary?
A: Look for routable listeners, passwordless modes, direct shell invocation, and SFTP or SSH settings that accept user-controlled fields.
Practitioner guidance
- Remove passwordless exposure from routable interfaces Bind Kopia servers to localhost where possible, and place any externally reachable instance behind an authenticating reverse proxy before exposing it to non-loopback traffic.
- Treat backup services as privileged non-human identities Inventory each Kopia deployment as a high-trust workload, then document its repository access, SSH dependencies, and the systems it can modify or restore.
- Block unsafe request-to-command paths Review any configuration fields that flow into shell or SSH arguments, then require allowlists, strict tokenisation, and rejection of unsupported ProxyCommand-style input.
What's in the full analysis
Orca Security's full analysis covers the operational detail this post intentionally leaves for the source:
- Affected version boundaries and the exact runtime conditions that make the issue exploitable
- The specific remediation path for upgrading to version 0.23.0 and removing insecure startup modes
- Exposure context in Orca's platform, including runtime reachability and asset criticality
- The advisory trail, including the merged GitHub fix and security advisory reference
👉 Read Orca Security's analysis of the Kopia unauthenticated RCE flaw →
Kopia RCE and backup server exposure: are your controls keeping up?
Explore further
10/06/2026 1:43 am
Unauthenticated backup administration is a control failure, not a convenience choice. The vulnerability works because the backup server was allowed to accept network traffic without a compensating authentication boundary while still holding a command execution path. That is a governance decision about trust, not just a patching issue. For identity teams, the lesson is that backup services with external reach must be governed like privileged infrastructure, not treated as background utilities.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable when an exposed backup service is used for remote code execution?
A: Accountability sits with the team that owns the workload, the network exposure, and the authentication design, not just the patch cycle. Frameworks such as OWASP-NHI and Zero Trust Architecture are relevant because they require explicit trust boundaries and least privilege for non-human services. The owner must be able to explain why the service was reachable at all.
👉 Read our full editorial: Kopia unauthenticated RCE exposes backup servers to full compromise
