CVE-2026-75627
Bastillion Authentication Bypass via Path-Prefix Routing Mismatch
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.
| CWE | CWE-288 |
| Vendor | bastillion-io |
| Product | bastillion |
| Published | Aug 18, 2026 |
| Last Updated | Aug 18, 2026 |
Stay Ahead of the Next One
Get instant alerts for bastillion-io bastillion
Be the first to know when new critical vulnerabilities affecting bastillion-io bastillion are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
bastillion-io / Bastillion
0 ≤ 5.1.0
References
github.com: https://github.com/bastillion-io/Bastillion/issues/669 github.com: https://github.com/bastillion-io/Bastillion github.com: https://github.com/bastillion-io/Bastillion/commit/d759fb686a1a097b1b026e286fd9b20e5ba349c8 github.com: https://github.com/bastillion-io/Bastillion/blob/master/src/main/java/loophole/mvc/base/BaseKontroller.java vulncheck.com: https://www.vulncheck.com/advisories/bastillion-authentication-bypass-via-path-prefix-routing-mismatch
Credits
🔍 George Chen