Bastillion npm Package Vulnerability: Critical Authentication Bypass
- Severity
- CRITICAL
- CVSS
- 9.8
- Affected component
- bastillion (npm)
- Affected versions
- >= v5.1.0, <= v5.1.0 or >= v5.0.1, <= v5.0.1 or >= v5.0.0, <= v5.0.0 or >= v4.0.1, <= v4.0.1 or >= v4.0.0, <= v4.0.0 or >= v3.15.00, <= v3.15.00 or >= v3.14.0, <= v3.14.0 or >= v3.13.00, <= v3.13.00 or >= v3.12.02, <= v3.12.02 or >= v3.12.01, <= v3.12.01 or >= v3.12.00, <= v3.12.00 or >= v3.11.01, <= v3.11.01 or >= v3.10.00, <= v3.10.00 or >= v3.09.00, <= v3.09.00 or >= v3.08.01, <= v3.08.01 or >= v3.08.00, <= v3.08.00 or >= v3.06.04, <= v3.06.04 or >= v3.06.03, <= v3.06.03 or >= v3.06.02, <= v3.06.02 or >= v3.06.01, <= v3.06.01 or >= v3.06.00, <= v3.06.00 or >= v3.05.01, <= v3.05.01 or >= v3.02.00, <= v3.02.00 or >= v3.01.00, <= v3.01.00 or >= v3.00.03, <= v3.00.03 or >= v3.00.02, <= v3.00.02 or >= v3.00.01, <= v3.00.01 or >= v3.00.00, <= v3.00.00 or >= v2.90.03, <= v2.90.03 or >= v2.90.02, <= v2.90.02 or >= v2.90.01, <= v2.90.01 or >= v2.90.00, <= v2.90.00 or >= v2.89.00, <= v2.89.00 or >= v2.88.01, <= v2.88.01 or >= v2.88.00, <= v2.88.00 or >= v2.87.01, <= v2.87.01 or >= v2.87.00, <= v2.87.00 or >= v2.86.00, <= v2.86.00 or >= v2.85.03, <= v2.85.03 or >= v2.85.02, <= v2.85.02 or >= v2.85.01, <= v2.85.01 or >= v2.84.01, <= v2.84.01 or >= v2.84.00, <= v2.84.00 or >= v2.83.02, <= v2.83.02 or >= v2.83.01, <= v2.83.01 or >= v2.83.00, <= v2.83.00 or >= v2.82.00, <= v2.82.00 or >= v2.80.00, <= v2.80.00 or >= v2.75.00, <= v2.75.00 or >= v2.73.02, <= v2.73.02 or >= v2.73.01, <= v2.73.01 or >= v2.73.00, <= v2.73.00 or >= v2.70.01, <= v2.70.01 or >= v2.60.00, <= v2.60.00 or >= v2.50.02, <= v2.50.02 or >= v2.50.01, <= v2.50.01 or >= v2.50.00, <= v2.50.00 or >= v2.17.01, <= v2.17.01 or >= v2.17.00, <= v2.17.00 or >= v2.16.00, <= v2.16.00 or >= v2.15.27, <= v2.15.27 or >= v2.15.26, <= v2.15.26 or >= v2.15.25, <= v2.15.25 or >= v2.15.20, <= v2.15.20 or >= v2.15.10, <= v2.15.10 or >= v2.15.00, <= v2.15.00 or >= v2.12.00, <= v2.12.00 or >= v2.11.05, <= v2.11.05 or >= v2.11.00, <= v2.11.00 or >= v2.10.03, <= v2.10.03 or >= v2.10.02, <= v2.10.02 or >= v2.10.01, <= v2.10.01 or >= v2.10.00, <= v2.10.00 or >= v2.06.00, <= v2.06.00 or >= v2.05.02, <= v2.05.02 or >= v2.05.01, <= v2.05.01 or >= v2.05.00, <= v2.05.00 or >= v2.02.02, <= v2.02.02 or >= v2.02.01, <= v2.02.01 or >= v2.02.00, <= v2.02.00 or >= v2.01.00, <= v2.01.00 or >= v2.00.00, <= v2.00.00 or >= v1.08.54, <= v1.08.54 or >= v1.08.53, <= v1.08.53 or >= v1.08.52, <= v1.08.52 or >= v1.08.51, <= v1.08.51 or >= v1.08.50, <= v1.08.50 or >= v1.08.40, <= v1.08.40 or >= v1.08.30, <= v1.08.30 or >= v1.08.20, <= v1.08.20
- Patched version
- Not yet available
An early warning has been issued for a critical vulnerability in the Bastillion npm package. The vulnerability, tracked as CVE-2026-75627, allows unauthenticated attackers to bypass authentication filters and gain administrative access.
What happened
The vulnerability in Bastillion arises from improper validation of request URI paths in its controller dispatcher. This flaw enables attackers to prefix requests with arbitrary path segments, thereby bypassing authentication filters. As a result, attackers can access administrative controllers, read user listings, create manager accounts, and register managed systems. This grants them control over SSH access to the managed fleet.
The affected versions of Bastillion span a wide range, from v5.1.0 down to v1.08.20. This extensive range indicates that many installations may be vulnerable. The vulnerability has a CVSS score of 9.8, categorizing it as critical.
What to do about it
- Investigate the use of Bastillion in your environment to determine if you are running an affected version.
- Consider alternative solutions or implement mitigations to secure your systems until a patch is available.
- Monitor the primary sources for updates on the vulnerability and any released patches.
- If you are using an affected version, restrict access to Bastillion instances to trusted networks and users as a temporary measure.
- No official fix has been published yet. Continue to monitor the sources below for updates on patches or mitigations.
How 0Day would have caught this
bastillion is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are affected if you are using Bastillion npm package versions ranging from v5.1.0 down to v1.08.20.
What should I do right now?
Investigate your use of Bastillion and consider alternative solutions or mitigations. Monitor primary sources for updates on patches.
Is there a patch available?
No official fix has been published yet. Continue to monitor the sources for updates.