CVE-2026-62943: btrbk SSH Filter Auth Bypass Vulnerability

CVE-2026-62943 Overview

CVE-2026-62943 is a command injection vulnerability in btrbk, a tool for creating snapshots and remote backups of Btrfs subvolumes. The flaw exists in ssh_filter_btrbk.sh, which constructs the allow_stream_match regular expression with a start anchor but no end-of-string anchor. A user restricted through an authorized_keys forced command can append a trailing pipe command after a valid btrbk command prefix, bypassing the allowlist. Successful exploitation executes arbitrary commands with the privileges of the backup-target SSH account. Versions from 0.29.0 up to but not including 0.32.7 are affected. Deployments that do not use ssh_filter_btrbk.sh in authorized_keys are not affected.

Critical Impact
Authenticated remote attackers can bypass the SSH command allowlist and execute arbitrary shell commands as the backup-target account.

Affected Products

btrbk versions 0.29.0 through 0.32.6
Deployments using ssh_filter_btrbk.sh inside authorized_keys forced commands
Btrfs remote backup targets receiving restricted SSH sessions

Discovery Timeline

2026-09-18 - CVE-2026-62943 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-62943

Vulnerability Analysis

The vulnerability, classified as OS Command Injection [CWE-78], resides in the SSH command filter shipped with btrbk. ssh_filter_btrbk.sh is designed to restrict what commands an authenticated SSH principal can run when acting as a backup target. It validates the incoming SSH_ORIGINAL_COMMAND against a compound regular expression stored in allow_stream_match. The regex includes an optional decompression and mbuffer prefix, an allowed btrbk command body, and an optional mbuffer or compression tail. Because the regex uses ^ at the start but omits $ at the end, grep -E returns success as long as the prefix matches, ignoring any trailing content. An attacker with permitted SSH access can append additional shell metacharacters and commands after a legitimate btrbk invocation and have them executed by the remote shell.

Root Cause

The root cause is an incomplete anchor in the allowlist regular expression. Specifically, stream_out_match terminated with $ only inside an optional group, and the overall allow_stream_match string lacked a trailing $. The pattern therefore matched any string beginning with a whitelisted command, regardless of what followed.

Attack Vector

Exploitation requires an SSH key entry that pins ssh_filter_btrbk.sh as a forced command. The attacker connects to the backup target and issues a command whose prefix is an accepted btrbk operation, then appends | arbitrary_command. The filter approves the request, and the login shell executes the full string, including the attacker-controlled suffix, under the SSH account's privileges.

bash

# Patch diff from ssh_filter_btrbk.sh (v0.32.7)
     # allow multiple paths (e.g. "btrfs subvolume snapshot <src> <dst>")
     allow_cmd_match="(${allow_list})( ${option_match})*( ${path_match})+"
     stream_in_match="(${decompress_match} \| )?(${mbuffer_match} \| )?"
-    stream_out_match="( \| ${mbuffer_match})?( \| ${compress_match}$)?"
+    stream_out_match="( \| ${mbuffer_match})?( \| ${compress_match})?"
 
     # `grep`'s `-q`-option is not used as it may cause an exit status of `0` even
     # when an error occurred.
 
-    allow_stream_match="^${stream_in_match}${allow_cmd_match}${stream_out_match}"
+    allow_stream_match="^${stream_in_match}${allow_cmd_match}${stream_out_match}$"
     if printf '%s' "${SSH_ORIGINAL_COMMAND}" | grep -E "${allow_stream_match}" >/dev/null 2>/dev/null; then
         return 0
     fi
# Source: https://github.com/digint/btrbk/commit/29ca3c093205395bdeb9dd98677ab4139c458aec

The fix moves the $ out of the optional inner group and appends it to the end of allow_stream_match, forcing the regex to match the entire SSH_ORIGINAL_COMMAND string.

Detection Methods for CVE-2026-62943

Indicators of Compromise

SSH sessions to backup-target accounts where SSH_ORIGINAL_COMMAND contains a btrbk or btrfs prefix followed by a pipe character and non-allowlisted binary invocations.
Auth logs showing forced-command sessions spawning unexpected child processes such as sh, bash, curl, wget, or nc.
Presence of btrbk versions between 0.29.0 and 0.32.6 on remote backup hosts referenced by authorized_keys filter entries.

Detection Strategies

Audit every authorized_keys entry that pins command="ssh_filter_btrbk.sh ..." and verify the installed btrbk version.
Alert on process-tree deviations where the parent is sshd under the backup account and the descendants are not btrfs, btrbk, mbuffer, or the configured compressor.
Search host telemetry for shell strings containing btrfs or btrbk immediately followed by | and an unexpected command name.

Monitoring Recommendations

Forward sshd and auth.log events from backup targets into a centralized log store and retain SSH_ORIGINAL_COMMAND values.
Baseline the allowed btrbk command set and flag any deviation on receiver hosts.
Track outbound network connections initiated by the backup-target SSH account, which should normally have none.

How to Mitigate CVE-2026-62943

Immediate Actions Required

Upgrade btrbk to version 0.32.7 or later on every host where ssh_filter_btrbk.sh is invoked from authorized_keys.
Inventory all SSH keys used for btrbk replication and rotate any credentials that reached vulnerable receivers.
Review historical shell and auth logs on backup targets for evidence of pipe-suffix command injection.

Patch Information

The issue is fixed in btrbk 0.32.7. The upstream patch adds a trailing $ end-of-string anchor to allow_stream_match in ssh_filter_btrbk.sh, forcing complete-string matching. See the GitHub Security Advisory GHSA-pf45-7g54-65h5, the fix commit 29ca3c0, and the btrbk v0.32.7 release notes.

Workarounds

Restrict the backup-target SSH account with a locked-down shell such as rssh or a chroot that blocks arbitrary binaries.
Replace ssh_filter_btrbk.sh temporarily with an inline command= allowlist that matches only exact expected command strings.
Limit inbound SSH to the backup account by source IP using from="..." restrictions in authorized_keys.