CVE-2026-75627 is an authentication bypass vulnerability in bastillion-io Bastillion affecting versions up to and including 5.1.0. The vulnerability arises because Bastillion fails to properly validate request URI paths in its controller dispatcher. Attackers can exploit this by prefixing requests with arbitrary path segments, thereby bypassing authentication filters. This unauthorized access allows attackers to reach administrative controllers, enabling them to read user listings, create privileged manager accounts, and register managed systems. Such actions can lead to full control over SSH access to the managed fleet.

Successful exploitation of this vulnerability allows unauthenticated attackers to bypass authentication controls and gain administrative access to Bastillion. This includes the ability to enumerate users, create privileged accounts, and register systems for management, effectively compromising SSH access control for the entire managed environment. The CVSS 4.0 base score of 9.3 reflects the critical severity and the high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to Bastillion interfaces and monitor for suspicious activity related to unauthorized administrative access attempts.