Critical Unauthenticated RCE Flaw Threatens Kopia Backup Servers

Kopia contains a critical RCE vulnerability (CVE-2026-45695) in its HTTP server where unauthenticated attackers can inject an -oProxyCommand token into storage configuration fields (e.g., via the /api/v1/repo/exists endpoint when the server is started with --without-password and uses SFTP/SSH backends), allowing arbitrary command execution as the Kopia process user; organizations should immediately apply the provided patch, avoid starting servers without passwords, and restrict exposure to non-loopback interfaces.