A flaw in the Public Key Management System controller of Bastillion allows an attacker to inject and execute arbitrary operating‑system commands on the host running the Bastillion service. The vulnerability, rated CVSS 5.1, is rooted in unsafe handling of user supplied input in AuthKeysKtrl.java, corresponding to CWE-74 and CWE-77 weaknesses. Successful exploitation could compromise confidentiality, integrity, and availability by allowing the execution of arbitrary shell commands.

Bastillion software up to and including version 4.0.1 is affected. The flaw resides in the AuthKeysKtrl.java component of the public key management subsystem. No other versions or components are listed as affected.

The CVSS base score of 5.1 places the issue in the medium severity range, while the EPSS of less than 1% indicates a very low probability of exploitation at this time. The vulnerability is not present in the CISA KEV catalog, and no public exploits are reported. Attackers can trigger the injection remotely via the exposed management interface; no local privilege is required beyond a valid authenticated session for the key‑management API or UI. Because the flaw is already publicly disclosed, a determined attacker could attempt to exploit it as soon as the vulnerability is discovered.