CVEvulnerability
CVE-2026-75627
9.3 CRITICAL
Official page ↗
- Status
- Deferred
- Published
- 2026-08-18
- Last modified
- 2026-10-22
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 9.3 CRITICAL — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-288
Description
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.
Related
Weakness · CWE (1)
- CWE-288 Authentication Bypass Using an Alternate Path or Channel weakness
References
- https://github.com/bastillion-io/Bastillion github.com
- https://github.com/bastillion-io/Bastillion/blob/master/src/main/java/loophole/mvc/base/BaseKontroller.java github.com
- https://github.com/bastillion-io/Bastillion/commit/d759fb686a1a097b1b026e286fd9b20e5ba349c8 github.com
- https://github.com/bastillion-io/Bastillion/issues/669 github.com
- https://www.vulncheck.com/advisories/bastillion-authentication-bypass-via-path-prefix-routing-mismatch www.vulncheck.com
- https://github.com/bastillion-io/Bastillion/issues/669 github.com