Authentication Bypass in Bastillion by Bastillion-io

CVE-2026-75627

What is CVE-2026-75627?

Bastillion is susceptible to an authentication bypass vulnerability due to improper validation of request URI paths within its controller dispatcher. This flaw allows unauthenticated attackers to manipulate URI requests by incorporating arbitrary path segments, effectively bypassing essential authentication filters. Consequently, these attackers can gain unauthorized access to sensitive administrative controllers, enabling them to view user listings, create unauthorized manager accounts, and register managed systems. This exploit could lead to control over SSH access to the entire managed fleet, presenting significant security risks to the system.

References