A path-prefix routing flaw in Bastillion lets unauthenticated attackers reach administrative controllers on a system that brokers SSH access to managed hosts, earning a CVSS 3.1 score of 9.8 (CRITICAL).
What Is It
Bastillion fails to properly validate request URI paths in its controller dispatcher. Because the dispatcher and the authentication filter disagree on how a path is interpreted, an attacker can prefix a request with arbitrary path segments and slip past the filter entirely; no credentials, no user interaction.
The issue is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). VulnCheck, the disclosing party, rates it CVSS 4.0 9.3 and CVSS 3.1 9.8, both CRITICAL, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, network-reachable, low complexity, no privileges required, and high impact to confidentiality, integrity, and availability.
Why It Matters
Once past the filter, the advisory describes attackers reaching administrative controllers to read user listings, create manager accounts, and register managed systems. Bastillion is an SSH access gateway, so that last capability is the sharp end: administrative control of the Bastillion instance would plausibly extend to the SSH access it brokers. How far that reaches in practice, and whether it converts into persistent footing on the managed hosts themselves, depends on deployment specifics such as key handling and host configuration, which the advisory does not detail.
There is no CISA KEV entry for CVE-2026-75627 at this time, and the NVD record lists exploit maturity as "not defined"; active exploitation is not confirmed in the supplied data.
What's Vulnerable
- Vendor: bastillion-io
- Product: Bastillion
- Affected versions: all versions up to and including 5.1.0
- Component: the controller dispatcher, specifically
src/main/java/loophole/mvc/base/BaseKontroller.java
Patch Status
NVD status is "Received" as of 2026-08-18, and no CISA required-action deadline applies. A fix commit exists upstream (d759fb68), and the issue is tracked publicly as Bastillion issue #669. Operators running 5.1.0 or earlier should move to a build containing that commit and, in the interim, restrict network exposure of the Bastillion web interface.
Sources
- NVD, CVE-2026-75627: https://nvd.nist.gov/vuln/detail/CVE-2026-75627
- VulnCheck Advisory; Bastillion Authentication Bypass via Path Prefix Routing Mismatch: https://www.vulncheck.com/advisories/bastillion-authentication-bypass-via-path-prefix-routing-mismatch
- Bastillion Repository: https://github.com/bastillion-io/Bastillion
- Affected Source; BaseKontroller.java: https://github.com/bastillion-io/Bastillion/blob/master/src/main/java/loophole/mvc/base/BaseKontroller.java
- Fix Commit d759fb68: https://github.com/bastillion-io/Bastillion/commit/d759fb686a1a097b1b026e286fd9b20e5ba349c8
- Bastillion Issue #669: https://github.com/bastillion-io/Bastillion/issues/669