Critical Vulnerability in BorgBackup and BorgBackup2: CVE-2026-62268
Summary
DEBIAN-CVE-2026-62268: ... Affects borgbackup versions 1.1.16-3 – 1.4.5-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
BorgBackup is a deduplicating backup program that is designed to be efficient and secure. It allows users to create backups of their data while minimizing storage space through deduplication techniques. BorgBackup2 is an updated version that offers enhanced features and improvements. Both packages are widely used in Debian environments for data protection. However, they are currently affected by a critical vulnerability that could compromise the integrity and security of backups.
Vulnerability Detail
CVE-2026-62268 is a vulnerability affecting both BorgBackup and BorgBackup2, introduced from version 0. This vulnerability could allow an attacker to exploit the backup process, potentially leading to unauthorized access to sensitive data or corruption of backup files. The exact technical details of the vulnerability are still under investigation, but it poses a significant risk to users relying on these packages for data security.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users are advised to limit access to the backup files and ensure that only trusted users have permissions to execute backup operations. Additionally, consider using alternative backup solutions until the vulnerability is patched.
Conclusion
The CVE-2026-62268 vulnerability poses a serious risk to users of BorgBackup and BorgBackup2. It is crucial to update to the latest patched versions to ensure the security of your backup data. Implementing workarounds can help mitigate risks until the update is applied.
See every vulnerability recorded for borgbackup →
FAQ
CVE-2026-62268 is a critical vulnerability affecting BorgBackup and BorgBackup2 that could allow unauthorized access to backup data.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, consider implementing strict access controls and using alternative backup solutions until a fix is available.
Yes, users are encouraged to update to the latest versions of BorgBackup and BorgBackup2, which will include the necessary patches.
More information can be found in the Debian security advisories and the official CVE database.
References
Related vulnerabilities
Recent vulnerabilities recorded for borgbackup.
