CVE-2026-62943: btrbk: SSH Command Filter Bypass in ssh_filter_btrbk.sh
btrbk is a tool for creating snapshots and remote backups of Btrfs subvolumes. From 0.29.0 until 0.32.7, btrbk's sshfilterbtrbk.sh constructs allowstreammatch with a start anchor but without an end-of-string anchor for the complete command. A user restricted through an authorizedkeys forced command can append a trailing pipe command after a valid btrbk command prefix, bypassing the allowlist and executing arbitrary commands with the privileges of the backup-target SSH account. Deployments that do not use sshfilterbtrbk.sh in authorizedkeys are not affected. This issue is fixed in version 0.32.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
btrbkto a version that resolves this vulnerability.Fixed in 0.32.7
Event History
Frequently Asked Questions
Which deployments are affected?
Only deployments that use ssh_filter_btrbk.sh as an authorized_keys forced command are affected. Deployments that do not use this script in authorized_keys are not affected.
What access does an attacker need to exploit this issue?
The attacker needs access as a user restricted through an authorized_keys forced command using ssh_filter_btrbk.sh. They can append a pipe and trailing command to an otherwise valid btrbk command prefix.
What is the impact of successful exploitation?
A successful bypass allows arbitrary command execution with the privileges of the backup-target SSH account.
What version fixes the issue?
The issue is fixed in btrbk version 0.32.7.