---
id: CVE-2026-75627
title: >-
  Bastillion fails to properly validate request URI paths in its controller
  dispatcher, allowing unauthenticated attackers to bypass authentication
  filters by prefixing requests with arbitrary path segments
summary: >-
  Bastillion fails to properly validate request URI paths in its controller
  dispatcher, allowing unauthenticated attackers to bypass authentication
  filters by prefixing requests with arbitrary path segments. Attackers can
  access administra…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-288
vendor: bastillion-io
product: Bastillion
affected:
  - Bastillion <= 5.1.0
published: '2026-08-18'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:42.873'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-75627'
references:
  - url: 'https://github.com/bastillion-io/Bastillion'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/bastillion-io/Bastillion/blob/master/src/main/java/loophole/mvc/base/BaseKontroller.java
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/bastillion-io/Bastillion/commit/d759fb686a1a097b1b026e286fd9b20e5ba349c8
    label: disclosure@vulncheck.com
  - url: 'https://github.com/bastillion-io/Bastillion/issues/669'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/bastillion-authentication-bypass-via-path-prefix-routing-mismatch
    label: disclosure@vulncheck.com
  - url: 'https://github.com/bastillion-io/Bastillion/issues/669'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00844
epssPercentile: 0.56206
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-08-18T18:06:21.598629Z'
ingestedAt: '2026-09-17T18:25:15.985Z'
---

## Overview

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments. Attackers can access administrative controllers to read user listings, create manager accounts, and register managed systems, gaining control over SSH access to the managed fleet.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.