What’s Vulnerable › Vulnerabilities

CVE-2023-45140: Group-based JIT MFA bypass on scp and sftp in The Bastion

• Severity: medium (CVSS 4.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-11-08 · updated 2026-06-17
• Weakness: CWE-306

Description

The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. SCP and SFTP plugins don't honor group-based JIT MFA. Establishing a SCP/SFTP connection through The Bastion via a group access where MFA is enforced does not ask for additional factor. This abnormal behavior only applies to per-group-based JIT MFA. Other MFA setup types, such as Immediate MFA, JIT MFA on a per-plugin basis and JIT MFA on a per-account basis are not affected. This issue has been patched in version 3.14.15.

Affected products

• ovh the-bastion: before 3.14.15 — fixed in 3.14.15

How to fix

Upgrade to a fixed version: ovh the-bastion 3.14.15. Check the vendor advisory for mitigations.

References

• https://github.com/ovh/the-bastion/releases/tag/v3.14.15
• https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x
• https://github.com/ovh/the-bastion/releases/tag/v3.14.15
• https://github.com/ovh/the-bastion/security/advisories/GHSA-pr4q-w883-pf5x

Get alerted when CVE-2023-45140 or the next vulnerability affects your stack