Kopia: Storage connection credentials written to console on "repository status" CLI command with JSON output
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-200.
Summary
### Impact _What kind of vulnerability is it? Who is impacted?_ Storage credentials are written to the console. ### Patches _Has the problem been patched?_ Yes, see #3589 _What versions should users upgrade to?_ - Any version after or including commit 1d6f852cd6534f4bea978cbdc85c583803d79f77 - No release has been created yet. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ - Be aware that `kopia repo status --json` will write the credentials to the output without scrubbing them. - Avoid executing `kopia repo status` with the `--json` flag in an insecure environment where. - Avoid logging the output of the `kopia repo status --json` command.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | github.com/kopia/kopia (Go) | before 0.16.0 | 0.16.0 | Patch available | GHSA-j5vm-7qcc-2wwg |
- github.com/kopia/kopia (Go) Vendor— Affected before 0.16.0 Fixed in 0.16.0 Patch available GHSA-j5vm-7qcc-2wwg
Remediation
- Fix · GHSA-j5vm-7qcc-2wwg github.com/kopia/kopia (Go) Fixed in 0.16.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-j5vm-7qcc-2wwg
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences