CVE-2026-75627

Name of the Vulnerable Software and Affected Versions Bastillion (affected versions not specified)

Description Bastillion fails to properly validate request URI paths in its controller dispatcher. This allows unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Consequently, attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, which enables them to gain control over SSH access to the managed fleet.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.