CVE-2026-75627: Bastillion Authentication Bypass via Path-Prefix Routing Mismatch
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.
Affected Software
Event History
Frequently Asked Questions
Who can realistically exploit this issue?
Any Bastillion instance whose web interface is reachable by an attacker is exposed, because exploitation is network-based and requires no authentication or user interaction. The issue can provide access to administrative controller functions.
What does an attacker need to exploit it?
An attacker needs only to send requests with arbitrary path segments prefixed to target URIs, exploiting the dispatcher’s path-prefix routing mismatch. No credentials or prior privileges are required.
What could an attacker do after bypassing authentication?
Successful exploitation can expose user listings, allow creation of manager accounts, and permit registration of managed systems. This can give the attacker control over SSH access to the managed fleet.