CVE-2026-1064 is a command injection vulnerability identified in bastillion-io Bastillion, an open-source SSH key management and session auditing tool, affecting versions 4.0.0 and 4.0.1. The vulnerability exists in the System Management Module, specifically within the src/main/java/io/bastillion/manage/control/SystemKtrl.java file. Improper input validation or sanitization in this component allows an attacker to manipulate input data to inject and execute arbitrary system commands remotely. The attack vector is network-based, requiring no user interaction or authentication, which significantly increases the risk of exploitation. The vulnerability was responsibly disclosed to the vendor, who has not responded or released a patch as of the publication date. The CVSS 4.0 score of 5.1 reflects a medium severity, considering the ease of remote exploitation but the requirement of high privileges (PR:H) to exploit. The vulnerability impacts confidentiality, integrity, and availability to a limited extent due to the partial scope and privilege requirements. No known exploits have been reported in the wild yet, but the public disclosure of the exploit details raises the risk of future attacks. Bastillion is widely used in enterprise environments for managing SSH access, making this vulnerability particularly concerning for organizations relying on it for secure infrastructure management.

The potential impact of CVE-2026-1064 is significant for organizations using Bastillion for SSH key management and session auditing. Successful exploitation could allow attackers to execute arbitrary commands on the Bastillion server, potentially leading to unauthorized access to sensitive credentials, modification or deletion of critical configuration files, and disruption of Bastillion services. This could cascade into broader network compromise, especially if Bastillion is integrated with critical infrastructure or used to manage access to multiple systems. The requirement for high privileges to exploit somewhat limits the attack surface but does not eliminate risk, especially in environments where Bastillion is deployed with elevated permissions or insufficient network segmentation. The lack of vendor response and patch availability increases exposure time, raising the likelihood of exploitation attempts. Organizations worldwide that depend on Bastillion for secure SSH management could face confidentiality breaches, integrity violations, and availability issues, impacting operational security and compliance.

1. Immediately restrict network access to Bastillion instances using firewall rules or network segmentation to trusted administrative networks only. 2. Monitor Bastillion logs and system command execution for unusual or unauthorized activities indicative of command injection attempts. 3. Employ host-based intrusion detection systems (HIDS) to detect anomalous command executions or privilege escalations on Bastillion servers. 4. Limit the privileges of the Bastillion service account to the minimum necessary to reduce the impact of a successful exploit. 5. If possible, deploy Bastillion instances in isolated environments or containers to contain potential compromise. 6. Engage in proactive vulnerability scanning and penetration testing focused on Bastillion deployments to identify exploitation attempts. 7. Stay alert for vendor updates or community patches and apply them promptly once available. 8. Consider alternative SSH key management solutions if patching or mitigation is not feasible in the short term. 9. Educate administrators about the risks of this vulnerability and the importance of secure Bastillion configuration and monitoring.