CVE-2026-75627 is an authentication bypass vulnerability in bastillion-io Bastillion caused by improper validation of request URI paths in the controller dispatcher. Attackers can bypass authentication filters by prefixing requests with arbitrary path segments, enabling unauthorized access to administrative controllers. This access allows reading user listings, creating manager accounts, and registering managed systems, which can lead to control over SSH access to the managed fleet. The vulnerability affects Bastillion versions from 0 up to and including 5.1.0 and has a CVSS 4.0 score of 9.3, indicating critical severity.

Unauthenticated attackers can bypass Bastillion's authentication mechanisms and gain administrative privileges. This includes the ability to read user listings, create privileged manager accounts, and register managed systems. Such control compromises the security of SSH access to the managed fleet, potentially allowing full control over those systems.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to Bastillion interfaces and monitor for suspicious activity related to unauthorized administrative access attempts.