Overview
A critical authentication bypass vulnerability has been identified in Bastillion, the open-source web-based SSH console and bastion host manager. Assigned CVE-2026-75627 with a CVSS score of 9.8, the flaw enables completely unauthenticated attackers to access administrative controllers, enumerate user accounts, and create manager-level users — effectively achieving full control over the system without any credentials.
Bastillion is used by organizations to manage privileged SSH access to servers and infrastructure. A successful exploitation can hand attackers administrative access to SSH key management across an entire server fleet.
Vulnerability Details
The vulnerability exists in Bastillion's controller dispatcher, which handles incoming HTTP requests and applies authentication filters. The dispatcher fails to properly validate URI paths, meaning an attacker can prefix any request with arbitrary path segments to cause the authentication filter to be bypassed entirely.
For example, a request to a protected administrative endpoint such as /admin/users can be re-prefixed as /arbitrary/../../admin/users (or similar path structures) in a way that the authentication check does not match the normalized path, while the controller still routes it to the protected handler correctly.
What an unauthenticated attacker can do:
- Read user listings — enumerate all accounts in the Bastillion user directory
- Create manager accounts — add attacker-controlled administrative users
- Access SSH key management — view, modify, or rotate SSH keys associated with managed servers
- Pivot to managed infrastructure — leverage added manager accounts to access any servers under Bastillion's control
CVSS Breakdown
| Metric | Value |
|---|---|
| Base Score | 9.8 (Critical) |
| Attack Vector | Network |
| Attack Complexity | Low |
| Privileges Required | None |
| User Interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity | High |
| Availability | High |
The absence of any authentication requirement and no user interaction needed makes this one of the most severe scores possible for a web application vulnerability.
Affected Software
- Bastillion — all versions with the flawed controller dispatcher (prior to the patch release)
Remediation
- Patch immediately once the vendor releases the fix via the Bastillion repository
- Restrict network access to your Bastillion instance — it should never be exposed directly to the internet; place it behind a VPN or firewall
- Audit user accounts and SSH keys for any unauthorized additions immediately — assume compromise if your Bastillion instance was accessible from untrusted networks
- Monitor Bastillion access logs for requests containing unusual path patterns (multiple
../or unexpected path prefixes before known endpoints) - Consider implementing an additional layer of authentication (e.g. SSO, client certificate) in front of Bastillion as defense in depth