← Back to the live CVE advisory feed

CVE-2026-62943: Product identification pending

Severity

8.7 (HIGH)

Fixed version

0.32.7.

Patch status

Patched

Published

2026-09-18T17:16:59.167

Modified

2026-09-18T17:16:59.167

Why it matters

This matters because the affected product has SSH, tunneling, or file-management capabilities. Compromise could let an attacker execute commands or interact with managed systems.

Recommended admin actions

• Review and patch based on exposure, asset criticality, and business impact.
• Compare installed versions against the affected version range in the advisory.
• Treat internet-facing systems as higher priority.
• Review logs for suspicious activity related to the affected application or component.

Technical summary

btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's ssh_filter_btrbk.sh constructs allow_stream_match with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorized_keys forced command can append a trailing pipe command after a valid btrbk command prefix, bypassing the allowlist and executing arbitrary commands with the privileges of the backup-target SSH account. Deployments that do not use ssh_filter_btrbk.sh in authorized_keys are not affected. This issue is fixed in version 0.32.7.

View the official NVD record for CVE-2026-62943

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.