CVE-2026-1063 is a medium-severity command injection vulnerability affecting bastillion-io Bastillion versions 4.0.0 and 4.0.1. The vulnerability resides in the Public Key Management System, specifically in the source file AuthKeysKtrl.java. Due to improper input validation or sanitization, an attacker can remotely inject and execute arbitrary operating system commands on the server hosting Bastillion. The attack does not require user interaction or authentication, which significantly lowers the barrier for exploitation. Bastillion is an open-source SSH key management solution used to centralize and secure SSH access. Exploiting this vulnerability could allow attackers to gain unauthorized control over the Bastillion server, potentially leading to further lateral movement within the network, data exfiltration, or disruption of services. The vendor was notified but has not issued a patch or response, and while no active exploits have been reported, the public disclosure of exploit details increases the risk of future attacks. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability, resulting in a medium overall severity rating.

If exploited, this vulnerability could allow attackers to execute arbitrary commands on Bastillion servers remotely, compromising the confidentiality, integrity, and availability of the system. Given Bastillion's role in managing SSH keys and access controls, attackers could leverage this to gain unauthorized access to critical infrastructure and internal networks. This could lead to unauthorized data access, privilege escalation, and disruption of secure access management. Organizations relying on Bastillion for SSH key management, especially those in sectors like finance, government, energy, and technology, face increased risk of targeted attacks. The lack of vendor response and patches prolongs exposure, increasing the window for potential exploitation. Although no active exploits are currently reported, the public availability of exploit information raises the likelihood of future attacks, particularly by opportunistic or advanced threat actors.

Organizations should immediately assess their use of Bastillion versions 4.0.0 and 4.0.1 and consider the following mitigations: 1) Restrict network access to Bastillion servers using firewalls and VPNs to limit exposure to trusted users only. 2) Monitor Bastillion server logs for unusual command execution or access patterns indicative of exploitation attempts. 3) Implement strict input validation and sanitization at the application or proxy level if possible, to block malicious command injection payloads. 4) Consider deploying Bastillion in isolated environments with minimal privileges to limit potential damage. 5) Regularly back up Bastillion configurations and SSH keys to enable recovery in case of compromise. 6) Engage with the Bastillion community or maintainers to track any forthcoming patches or updates addressing this vulnerability. 7) As a longer-term measure, evaluate alternative SSH key management solutions with active security support. 8) Employ intrusion detection and prevention systems to detect and block command injection attempts targeting Bastillion.