EUVD-2026-60578
GHSA-9v44-g22g-qfg5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable auth-filter bypass needing no credentials or interaction (AV:N/AC:L/PR:N/UI:N); full admin control of the bastion yields high C/I/A with scope unchanged.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.
AnalysisAI
Authentication bypass in Bastillion (bastillion-io/bastillion, all versions prior to the fix commit) lets unauthenticated remote attackers reach administrative controllers by prefixing request URIs with arbitrary path segments that the AuthFilter fails to normalize. Because the servlet-based access-management console governs SSH access to an entire managed fleet, an attacker can enumerate users, create manager accounts, and register systems, effectively seizing control of privileged SSH access. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The concrete prerequisite is network reachability to the Bastillion web/servlet endpoint plus a request whose raw URI carries an extra prefixed path segment that AuthFilter's getRequestURI()-based check misclassifies as unprotected while BaseKontroller.execute still dispatches it to a protected admin controller - no credentials, tokens, or user interaction are required (PR:N/UI:N/AT:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals point to a genuine high priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who can reach the Bastillion web interface sends an HTTP request to an administrative controller but prepends an arbitrary path segment so AuthFilter treats the URI as unprotected while BaseKontroller still routes it to the admin action. Without credentials the attacker reads the user listing, creates a new manager account, and registers managed systems, then pivots that manager access into SSH control of every host the bastion fronts. … |
| Remediation | Upstream fix available (PR/commit); released patched version not independently confirmed - apply vendor fix commit d759fb686a1a097b1b026e286fd9b20e5ba349c8, which changes AuthFilter to derive the request path from servletRequest.getServletPath() instead of the raw getRequestURI() so the filter's auth decision matches the dispatcher's routing, then rebuild and redeploy from the patched source (https://github.com/bastillion-io/Bastillion/commit/d759fb686a1a097b1b026e286fd9b20e5ba349c8) and watch issue #669 for a tagged release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Bastillion instances and confirm patch availability through the vendor advisory. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today