CVE-2026-1063: Bastillion Command Injection Vulnerability

CVE-2026-1063 Overview

A command injection vulnerability has been discovered in bastillion-io Bastillion up to version 4.0.1. This vulnerability affects the Public Key Management System component, specifically within the file src/main/java/io/bastillion/manage/control/AuthKeysKtrl.java. The flaw allows attackers to inject arbitrary commands through improper input handling, enabling remote exploitation.

Critical Impact

Remote attackers with high privileges can execute arbitrary commands on the target system through the Public Key Management functionality, potentially leading to complete system compromise.

Affected Products

• bastillion-io Bastillion up to version 4.0.1
• Bastillion Public Key Management System component
• AuthKeysKtrl.java in the manage control module

Discovery Timeline

• January 17, 2026 - CVE-2026-1063 published to NVD
• January 17, 2026 - Last updated in NVD database

Technical Details for CVE-2026-1063

Vulnerability Analysis

This command injection vulnerability (CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component) exists in the Bastillion web-based SSH console and key management solution. The vulnerability stems from inadequate input validation in the AuthKeysKtrl.java file, which handles public key management operations.

When processing user-supplied data related to SSH key management, the application fails to properly sanitize input before passing it to system commands. This allows an authenticated attacker with administrative privileges to inject malicious commands that will be executed in the context of the application server.

The attack can be launched remotely over the network without requiring user interaction. While the vulnerability requires high privileges to exploit, successful exploitation could allow an attacker to execute arbitrary commands on the underlying server, potentially compromising the entire infrastructure that Bastillion manages.

Root Cause

The root cause of this vulnerability is improper neutralization of special elements (CWE-74) in the AuthKeysKtrl.java component. The application does not adequately sanitize or validate user input before incorporating it into commands executed by the system. This lack of input validation allows specially crafted input containing command separators or shell metacharacters to be interpreted as executable commands rather than data.

Attack Vector

The attack is conducted remotely over the network. An authenticated user with administrative access to the Bastillion application can manipulate requests to the Public Key Management System to inject malicious commands. The vulnerable endpoint processes the tainted input and passes it to the underlying operating system shell, where the injected commands are executed.

The exploitation flow involves:

1. Authenticating to Bastillion with high-privilege credentials
2. Navigating to the Public Key Management functionality
3. Crafting a malicious request with injected shell commands
4. The application processes the input without proper sanitization
5. Injected commands execute on the server with application privileges

For technical details regarding the exploitation mechanism, refer to the GitHub Bastillion Report.

Detection Methods for CVE-2026-1063

Indicators of Compromise

• Unusual process execution spawned from the Bastillion Java application process
• Unexpected network connections initiated from the Bastillion server
• Anomalous entries in application logs related to public key management operations containing shell metacharacters (;, |, &, $(), backticks)
• Modified or newly created files in unexpected directories on the Bastillion server

Detection Strategies

• Monitor web application logs for requests to AuthKeysKtrl endpoints containing suspicious characters or patterns indicative of command injection
• Implement Web Application Firewall (WAF) rules to detect and block command injection attempts in requests to the Bastillion application
• Deploy endpoint detection and response (EDR) solutions to identify unusual child processes spawned by the Java runtime

Monitoring Recommendations

• Enable verbose logging on the Bastillion application to capture all requests to the Public Key Management component
• Configure SIEM alerts for patterns matching command injection attempts against Bastillion endpoints
• Monitor system call activity on the Bastillion server for unexpected command execution from the application context

How to Mitigate CVE-2026-1063

Immediate Actions Required

• Restrict network access to the Bastillion application to trusted administrative networks only
• Review and limit administrative privileges to reduce the potential attack surface
• Implement additional authentication controls such as multi-factor authentication for administrative access
• Consider temporarily disabling the Public Key Management functionality if not critical to operations

Patch Information

The vendor was contacted about this vulnerability but did not respond. At the time of publication, no official patch has been released by bastillion-io. Organizations using Bastillion should monitor the vendor's official channels and the VulDB entry for updates regarding a security fix.

Workarounds

• Deploy a Web Application Firewall (WAF) with rules configured to detect and block command injection patterns in requests to Bastillion
• Implement network segmentation to isolate the Bastillion server from critical infrastructure
• Use input validation at the network perimeter level to filter malicious requests before they reach the application
• Consider migrating to an alternative SSH key management solution until an official patch is available

# Example WAF rule to block common command injection patterns
# Add to your WAF configuration to protect Bastillion endpoints
# Block requests containing shell metacharacters in parameters
SecRule ARGS "@rx [;\|&\$\(\)`]" \
    "id:100001,\
    phase:2,\
    deny,\
    status:403,\
    msg:'Potential command injection attempt blocked',\
    logdata:'Matched Data: %{MATCHED_VAR}'"