CVE-2023-36811: Borgbackup Authentication Bypass
Summary
CVE-2023-36811: borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Affects borgbackup across 2 version ranges.
< 1.2.5
< 3eb070191da10c2d3f7bc6484cf3d51c3045f884
Fixed in 3eb070191da10c2d3f7bc6484cf3d51c3045f884. How to fix ↓
Also tracked for
- borgbackup · Debian:11
The same CVE-2023-36811 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Borgbackup is an open-source deduplicating archiver that provides compression and authenticated encryption. It is designed to create backups and store them in a repository. The repository contains archives that can be accessed and restored when needed. Borgbackup ensures data integrity and security through its cryptographic authentication scheme.
Vulnerability Detail
A flaw in the cryptographic authentication scheme of Borgbackup allows an attacker to create fake archives and potentially cause data loss in the repository. To exploit this vulnerability, the attacker needs to have the ability to insert files into backups without additional headers and gain write access to the repository. It's important to note that this vulnerability does not expose plaintext data to the attacker, nor does it affect the authenticity of existing archives. While creating plausible fake archives may be difficult for large archives, it is feasible for empty or small archives. The issue has been addressed in Borgbackup version 1.2.5.
How To Fix
Latest published version: 1.4.5 as of 23 Oct 2026
pip install --upgrade "borgbackup==1.4.5"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3eb070191da10c2d3f7bc6484cf3d51c3045f884
This is the first release that contains the fix.
pip install --upgrade "borgbackup==3eb070191da10c2d3f7bc6484cf3d51c3045f884"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Borgbackup authentication bypass vulnerability allows attackers to create fake archives and potentially cause data loss in the repository. Users are advised to upgrade to Borgbackup version 1.2.5 and follow the recommended upgrade procedure. Additionally, it is important to review the archives after running 'borg check --repair' to mitigate the risk of data loss. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for borgbackup →
FAQ
Borgbackup is an open-source deduplicating archiver that provides compression and authenticated encryption. It is used for creating backups and storing them in a repository.
This vulnerability allows an attacker to create fake archives and potentially cause data loss in the Borgbackup repository.
The attacker needs the ability to insert files into backups without additional headers and gain write access to the repository.
No, this vulnerability does not disclose plaintext to the attacker.
After upgrading to Borgbackup version 1.2.5, it is recommended to review the archives using the 'borg check --repair' command and ensure that the timestamps and contents are valid and as expected.
References
Related vulnerabilities
Recent vulnerabilities recorded for borgbackup.
