CVE-2026-62943: 
Linux Fedora vulnerability analysis and mitigation

CVE-2026-62943 is an OS command injection vulnerability in btrbk's ssh_filter_btrbk.sh script that allows restricted SSH users to bypass the command allowlist and execute arbitrary commands on the backup target server. It affects btrbk versions 0.29.0 through 0.32.6 (all releases prior to 0.32.7), developed by digint. The vulnerability was responsibly disclosed by @machin0r and the advisory was published on July 19, 2026, with the fix released the same day (GitHub Advisory, btrbk Release). It carries a CVSS v4.0 base score of 8.7 (High) (Feedly).

The root cause is an incomplete regular expression in ssh_filter_btrbk.sh (CWE-78: OS Command Injection). The script constructs the allow_stream_match pattern with a start-of-string anchor (^) but omits an end-of-string anchor ($) from the full command pattern, meaning the regex only validates the beginning of the SSH command string (GitHub Advisory). An attacker with SSH access who is restricted via an authorized_keys forced command can craft a command that begins with a valid btrbk command prefix and appends a pipe character (|) followed by arbitrary shell commands — the incomplete regex matches the valid prefix and allows the entire string through (Fix Commit). The bug was introduced in commit 8d0d7ed1 and only affects deployments using ssh_filter_btrbk.sh in authorized_keys for command filtering.

Successful exploitation allows a restricted SSH user to execute arbitrary OS commands with the full privileges of the backup-target SSH account, completely bypassing the intended command allowlist. This can result in full confidentiality, integrity, and availability compromise of the backup target system — including unauthorized access to backup data, modification or deletion of Btrfs snapshots, and potential lateral movement within the backup infrastructure (GitHub Advisory). Deployments not using ssh_filter_btrbk.sh in authorized_keys are not affected.

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (Feedly). The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability requires the attacker to already have SSH access to the target system (low-privilege network access), limiting the attack surface to users who are explicitly granted SSH access but restricted via the ssh_filter_btrbk.sh forced command mechanism. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

1. Identify target: Confirm the remote backup host uses ssh_filter_btrbk.sh as a forced command in its authorized_keys file (e.g., command="/usr/lib/btrbk/ssh_filter_btrbk.sh" ssh-rsa AAAA...).
2. Obtain SSH access: Use a legitimate SSH key that is authorized but restricted by the forced command filter — this could be a compromised backup client key or an insider threat scenario.
3. Craft malicious command: Construct an SSH command that begins with a valid btrbk command prefix (which satisfies the start-anchor regex match) and appends a pipe followed by an arbitrary shell command, e.g.: btrfs send /backup/snapshot | malicious_command.
4. Execute via SSH: Run the crafted command using the -o 'ForceCommand none' bypass or by setting SSH_ORIGINAL_COMMAND directly: ssh -i backup_key user@target 'btrfs send /path | id > /tmp/pwned'.
5. Achieve arbitrary execution: The incomplete regex in allow_stream_match matches the valid prefix and passes the full command (including the injected pipe payload) to the shell, executing the appended command with the SSH account's privileges (Fix Commit, GitHub Advisory).

• Logs: SSH auth logs (/var/log/auth.log or journalctl -u sshd) showing forced-command sessions with unusually long or pipe-containing SSH_ORIGINAL_COMMAND values; btrbk logs showing commands that include pipe characters followed by non-btrbk subcommands.
• Process: Unexpected processes spawned as the backup SSH user (e.g., sh, bash, curl, wget, nc, python) that are not children of a normal btrbk operation.
• File System: Unexpected files created in world-writable directories (e.g., /tmp) by the backup SSH account; new cron jobs, SSH authorized keys, or scripts added under the backup user's home directory.
• Network: Outbound connections from the backup target host to unknown external IPs initiated by the backup SSH user process.

Upgrade btrbk to version 0.32.7, which adds a proper end-of-string anchor ($) to the allow_stream_match regex in ssh_filter_btrbk.sh, preventing command injection via pipe characters (btrbk Release). Critically, the updated ssh_filter_btrbk.sh script must also be deployed to all remote backup hosts — upgrading only the client is insufficient. Until patching is possible, workarounds include: restricting SSH access to trusted clients only, monitoring SSH command execution and btrbk logs for suspicious activity, removing ssh_filter_btrbk.sh from authorized_keys and using alternative controls (dedicated backup user with limited filesystem permissions, network segmentation), or reconfiguring the backup server as a "fetch-only backup source" instead of a "backup target" (GitHub Advisory).

The vulnerability was responsibly disclosed by researcher @machin0r and acknowledged by the btrbk maintainer (digint) in the official GitHub Security Advisory (GitHub Advisory). Fedora issued security updates for btrbk packages, and the issue was covered by Linux security news outlets including linuxsecurity.com and pro-linux.de (Feedly). Tenable added detection via Nessus plugins (IDs 328870 and 330526) shortly after disclosure.