CVE-2026-75627: falha crítica em bastillion-io Bastillion
Bastillion Authentication Bypass via Path-Prefix Routing Mismatch
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.3epss 0.8%
Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
bastillion-io · BastillionCVEs relacionadas — bastillion-io Bastillion
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/bastillion-io/Bastillionhttps://github.com/bastillion-io/Bastillion/blob/master/src/main/java/loophole/mvc/base/BaseKontroller.javahttps://github.com/bastillion-io/Bastillion/commit/d759fb686a1a097b1b026e286fd9b20e5ba349c8https://github.com/bastillion-io/Bastillion/issues/669https://www.vulncheck.com/advisories/bastillion-authentication-bypass-via-path-prefix-routing-mismatch