2026-07-20 – Unauthenticated Privilege Escalation in REST API – Bastion

[SECURITY ADVISORY] Unauthenticated Privilege Escalation in REST API – WALLIX Bastion

Release Date: 20 Jul 2026

Last Updated: 20 Jul 2026

Identifiers: WSA-2026-07-0001

Severity: CRITICAL – CVSS 4.0 Base 10.0 – CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

1. Executive Summary

This vulnerability affects any operational Bastion 12.3 and 12.4.0 in any configuration.

It requires no authentication, no user interaction, and no special settings.

A critical vulnerability has been identified in the WALLIX Bastion REST API. A remote, unauthenticated attacker with network access to the API endpoint can obtain full administrative privileges on the appliance.

Successful exploitation grants complete control over the Bastion, including its configuration, its vault of privileged credentials, and its session recordings. We strongly urge all affected customers to upgrade without delay and to treat affected appliances as potentially compromised. A security patch is available.

? Coordinated public disclosure – act before September.

The independent security researchers who reported these vulnerabilities intend to publish full technical details in September 2026 Once released, information useful to attackers will be in the public domain. Apply the fixes as soon as they are available and well ahead of the September disclosure.

Do not wait.

2. Affected Products & Scope

The affected code path was introduced in the 12.3 branch. Versions below 12.3 are not affected.

? Risk Assessment

Exploitation requires only network access to the REST API endpoint (typically exposed on HTTPS / 443) on an operational appliance. No credentials, valid session, or user interaction are needed. Any Bastion actively in service should be considered exposed.

3. Vulnerability Details

Type: CWE-290 (Authentication Bypass by Spoofing) / CWE-287 (Improper Authentication).

Description: Under certain conditions the REST API authentication layer can be induced to grant a privileged administrative session without valid credentials.

Access: Remote, network access to the API endpoint. No authentication required.

Technical exploitation details are intentionally withheld to protect customers until patch adoption is sufficiently widespread.

4. Detection & Indicators of Compromise

State-changing actions are logged. Operations that modify state (creating/editing users, changing configuration) are recorded in /var/log/wabaudit.log. Entries follow this format:

<date> <host> wabengine: [wabaudit] action=”<verb>” type=”<Object>” object=”<name>” user=”<actor>” client_ip=”<ip>” infos=”<changed fields>”

These informations are also sent to a SIEM system if configured.

Primary indicator — administrator creation performed by the internal service account identity. A session obtained through this vulnerability acts as an internal service account principal from the loopback address. Any wabaudit.log entry such as the following is highly suspicious, because a legitimate administrator action is never recorded this way:

Jul  4 14:12:07 bastion wabengine: [wabaudit] action=”add” type=”XXX” object=”XXX” user=”XXXX” client_ip=”127.0.0.1″ infos=”cn [‘backdoor’], profile [‘product_administrator’], userPassword [‘********’], userauths [‘local_password’ ]”

Look in particular for:

• client_ip=”127.0.0.1″ on any state-changing action (action=”add”, “edit”, “delete”) — especially type=”User” creating a product_administrator. This actor/IP pair for administrative changes is the strongest indicator of exploitation.
• Creation of administrator accounts you did not provision, or configuration/authorization changes with no matching interactive administrator login.

Review scope: examine /var/log/wabaudit.log (and rotated archives) — and, for credential-checkout activity, /var/log/vault-activity.log — across the entire window during which an affected version was network-reachable. Log review can confirm compromise but can never rule it out.

Exploitation can be entirely invisible.

Control Release of first version affected is 10 Feb 2026 , if you don´t have a logs retention (either on Bastion or in SIEM) before this date or installation of vulnerable version, you will not be able to assert if a exploitation was made.

Absence of evidence must not be interpreted as absence of compromise. Treat any affected, network-reachable appliance as potentially fully compromised, including all vault secrets.

5. Resolution & Action Plan

Recommended Action: Apply the Security Patch

Upgrade to WALLIX Bastion 12.4.1 or higher. This is the only effective remediation.

The WOPAM SaaS environments are currently being updated by WALLIX, in coordination with our customers.

Because exploitation may leave no trace (see §4), after patching we strongly recommend, if you can not assert that no exploitation was made:

• Rotate all secrets held in the vault(target account passwords, SSH keys, API keys). Assume every secret the appliance stored may have been read.
• Rotate Bastion administrator and API credentials.
• Audit accounts and configurationfor unexpected administrators or unauthorized changes, using the indicators in §4.

Credits

This vulnerability was discovered and responsibly reported by Fabien J. (SNS-Security). We thank SNS-Security for their coordinated disclosure.

Contact & Support

For assistance with the mitigation steps, please contact our support by opening a ticket on the support portal.