CVE-2026-75627: Bastillion Auth Bypass Vulnerability

CVE-2026-75627 Overview

CVE-2026-75627 is an authentication bypass vulnerability in Bastillion, a web-based SSH bastion and key management tool. The flaw resides in the controller dispatcher, which fails to properly validate request URI paths. Unauthenticated attackers can bypass the authentication filter by prefixing requests with arbitrary path segments. Successful exploitation grants access to administrative controllers, allowing attackers to enumerate users, create manager accounts, and register managed systems. This leads to full control over SSH access across the managed server fleet. The vulnerability is classified as [CWE-288: Authentication Bypass Using an Alternate Path or Channel].

Critical Impact
Unauthenticated remote attackers can gain administrative control over Bastillion and SSH access to every managed host in the fleet.

Affected Products

Bastillion SSH bastion and key management server
Bastillion BaseKontroller dispatcher component
Bastillion AuthFilter authentication filter component

Discovery Timeline

2026-08-18 - CVE-2026-75627 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75627

Vulnerability Analysis

Bastillion routes incoming HTTP requests through a custom dispatcher in BaseKontroller.execute(). The dispatcher resolves the target controller by inspecting the request URI. The AuthFilter component makes authorization decisions based on the raw HttpServletRequest.getRequestURI() value combined with String.contains() checks. This mismatch between how the filter interprets a path and how the dispatcher resolves it creates an authentication bypass. An attacker can prepend arbitrary path segments to a protected endpoint. The filter evaluates the prefixed path and permits the request, while the dispatcher still routes it to the intended administrative controller.

Root Cause

The root cause is inconsistent path normalization between the servlet filter and the MVC dispatcher. getRequestURI() returns the raw, unnormalized request path including any attacker-controlled prefixes. Using contains() against this string, rather than an exact match against the normalized servlet path, allows the filter's routing logic to disagree with the controller dispatcher.

Attack Vector

Exploitation requires only network access to the Bastillion web interface. No credentials, user interaction, or prior privileges are needed. An attacker sends a crafted HTTP request with a benign-looking prefix before an administrative endpoint. The AuthFilter fails to identify the request as privileged, while the dispatcher still executes the administrative handler. Attackers can invoke endpoints that list users, create manager accounts, and register managed systems, granting SSH access across the fleet.

java

                 //check if valid admin auth token
                 String userType = AuthDB.isAuthorized(AuthUtil.getUserId(servletRequest.getSession()), authToken);
                 if (userType != null) {
-                    String uri = servletRequest.getRequestURI();
+                    // Normalized servlet path, not the raw request URI - see BaseKontroller.execute()
+                    // for why raw getRequestURI() + contains() is unsafe for path-based auth decisions.
+                    String uri = servletRequest.getServletPath();
                     if (Auth.MANAGER.equals(userType)) {
                         isAdmin = true;
                     } else if (!uri.contains("/manage/") && Auth.ADMINISTRATOR.equals(userType)) {

Source: Bastillion Commit d759fb6

Detection Methods for CVE-2026-75627

Indicators of Compromise

HTTP access logs containing unusual path prefixes before Bastillion controller endpoints, such as double slashes, dot segments, or unrelated directories preceding /manage/ routes.
Unexpected creation of administrator or manager accounts in the Bastillion user database without a corresponding authenticated session.
New managed systems, SSH keys, or profiles registered from unfamiliar source IP addresses.
Successful HTTP 200 responses to administrative endpoints from sessions that never completed the login flow.

Detection Strategies

Compare the values of getRequestURI() and getServletPath() in application logs. Divergence between these values on requests to administrative controllers indicates exploitation attempts.
Alert on requests to Bastillion admin endpoints that lack a preceding authentication event in the same session.
Correlate new account creation and system registration events with the authenticated user identity. Events with no valid user session should be treated as suspicious.

Monitoring Recommendations

Ingest Bastillion web access logs and application logs into a centralized log platform for correlation and retention.
Enable audit logging for user, key, and system management operations, and alert on high-privilege changes.
Monitor SSH session initiation on managed hosts for connections that were not authorized through a known Bastillion administrator.

How to Mitigate CVE-2026-75627

Immediate Actions Required

Update Bastillion to the version containing commit d759fb6, which replaces getRequestURI() with getServletPath() in AuthFilter and hardens WebSocket terminal authentication.
Restrict network access to the Bastillion web interface using firewall rules or a VPN until patching is complete.
Audit the Bastillion user database for unexpected administrator or manager accounts and remove any that cannot be attributed to an authorized change.
Rotate SSH keys and credentials managed by Bastillion if compromise cannot be ruled out.

Patch Information

The vendor fix is available in Bastillion Commit d759fb6. The patch changes the AuthFilter to evaluate the normalized servlet path rather than the raw request URI, hardens WebSocket terminal authentication, and introduces LoginThrottleUtil for per-IP login throttling. Additional context is available in the VulnCheck Advisory: Bastillion Bypass and Bastillion Issue #669.

Workarounds

Place Bastillion behind a reverse proxy that normalizes request URIs and rejects paths containing redundant slashes, dot segments, or unexpected prefixes before administrative routes.
Restrict access to the Bastillion administrative interface to a management VLAN or bastion network reachable only from trusted operator workstations.
Enforce network-level authentication such as mutual TLS or an authenticating proxy in front of Bastillion until the patched version is deployed.

bash

# Example nginx configuration to normalize paths and restrict admin access
location / {
    # Reject requests with suspicious path segments before proxying
    if ($request_uri ~* "(//|/\.\./|/\./)") { return 400; }
    proxy_pass http://bastillion-backend;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
}

location /admin/ {
    allow 10.0.0.0/24;   # management network
    deny all;
    proxy_pass http://bastillion-backend;
}