Multi-framework compliance & security platform for scale-up companies. AI-generated from public sourcesThe starting point for every profile: auto-generated by 0-Doubt from public vendor materials, and not yet confirmed by the vendor or an independent analyst. Nothing here is hidden or overstated — it simply has not been reviewed yet.Where every profile starts, before the vendor or an analyst has reviewed it. A higher label means a more independent source — not a better product.How trust works →
Tools & products
Read by an AI model from bastion.tech’s own pages. What the vendor says it does, not independently verified.
Integrates with: Cloudflare ↗, GitHub ↗, GitLab ↗, Google ↗, JumpCloud ↗, Microsoft ↗, Native Security ↗, NinjaOne ↗,
2 of 5 independent trust signals established
Bastion has 2 dimensions with established evidence. The rest have not been confirmed yet.
Not yet established: Independently verified · Disclosure posture · Momentum
Has anyone other than the vendor confirmed this?
Nothing here has been confirmed by an independent third party yet.
Is this a real, durable business?
How long this vendor has been operating, and who stands behind them.
Security headers (4/5) — checked 10/18/2026
Infrastructure & transparency signals
2 CVEs have an estimated 10%-or-higher chance of having already been exploited despite not appearing on CISA's KEV catalog. KEV is a curated record of confirmed cases rather than a complete census, so this is where its coverage is likely thinnest — an estimate from EPSS history, not a finding. Based on a median of 2 EPSS observations per CVE.
Likely-exploited estimates here rest on a median of 2 EPSS observations per CVE — too little history to read as a trend yet. It deepens daily as scores are collected.
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible-based automation rendering can evaluate attacker-controlled…
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_user_role in warpgate-admin/src/api/users.…
Not a quality rating or endorsement — a measure of how much verified, disclosed data we actually have about this vendor. A low score usually means "we don't have much verified information yet," not "this is a bad vendor." Never used to sort or rank vendor lists.
The platform admin controls the formula's weights.
Product information on this page is auto-generated by 0-Doubt from public sources and not yet confirmed by the vendor or an independent analyst, unless an item is individually labelled otherwise. How trust works →
Integrated by: Adaptive, Axiom Security, Devolutions, Gurucul, Sekoia.io, Tenable, UncommonX, eMudhra
What do they do when something goes wrong?
What their public record shows about handling vulnerabilities and outages.
Do they tell you the awkward things unprompted?
How much this vendor volunteers before you have to ask.
Are they still shipping, or coasting?
Whether this vendor is visibly still building.
JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3.…
JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated …
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerabilit…
JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpSer…
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the pr…
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the response_mode=form_post SSO return path in warpgate-protocol-http/src/api/sso_provider_list.rs uses serde_j…
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.23.0 until 0.27.3, HTTP API token authentication resolves ConfigProvider::validate_api_token into RequestAuthorization::U…
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.rs protects /@warpgate/admin/api/recording…
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, copy_server_request in warpgate-protocol-http/src/proxy.rs forwards a client-supplied x-warpgate-username heade…
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.5, the /@warpgate/api/sso/providers/:name/start endpoint stores an attacker-controlled next parameter that the POS…
JumpServer is an open source bastion host and an operation and maintenance security audit system. From 4.8.0 until 4.10.17, an authenticated user with SFTP permission to an authorized asset can submit…
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, a user with the users.invite_user permission can submit an existing member to POST /…
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permission…
Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.23.3, the SSO flow does not validate the state parameter, which makes it possible for an attacker to trick a user int…
JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists in JumpServer's Applet and VirtualApp upl…
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certificates in the Custom SMS API Client. When…
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses the Referer header as the redirection ta…
Azure Bastion Elevation of Privilege Vulnerability
Anheng Mingyu Operation and Maintenance Audit and Risk Control System up to 2023-08-10 contains a server-side request forgery (SSRF) vulnerability in the xmlrpc.sock handler. The product accepts speci…
JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged authenticated user can invoke LDAP configurat…
JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts, an authenticated, non-privileged user c…
The Bastion provides authentication, authorization, traceability and auditability for SSH accesses. Session-recording ttyrec files, may be handled by the provided osh-encrypt-rsync script that is a he…
We understood that building a strong security program would take a tremendous amount of time and effort. With so many other priorities across our product and customer roadmap, it just didn't make sense to take it all on ourselves
We started with a competitor but made no progress. Bastion provided real security expertise, hands-on support, and automation that truly reduced our workload, making the switch a no-brainer
With Bastion, we transformed our security approach from ad-hoc processes to a fully structured, AI-aware SOC 2 compliance framework, all without slowing down AI development. Bastion's expertise in AI security and hands-on approach made compliance seamless
We started with a competitor but made no progress. Bastion provided real security expertise, hands-on support, and automation that truly reduced our workload, making the switch a no-brainer
Bastion didn't just give us a checklist, it gave us a dedicated security expert. Their GRC platform, security tools, hands-on approach and vCISO support made our compliance journey faster and stress-free
Bastion takes 'founder mode' to the next level. The team is incredibly reactive and always ready to help, ensuring everything runs smoothly. Their hands-on approach, efficiency, and deep understanding of startups make a real difference. Highly recommended!
Bastion delivers efficient & practical security. It's fast, pragmatic, and perfectly tailored to startups. The platform is seamless, the support outstanding, and the execution top-notch. We've evolved, saved time, and gained confidence, all while staying on budget. Truly game-changing
Bastion made it easy for us to collaborate and get audit-ready without slowing down product development
Bastion provided exceptional support every step of the way. The audit kicked off promptly, ran seamlessly, and returned with zero issues. The combination of the platform and expert guidance has saved us time and made a real impact. Truly impressive!
Bastion delivers efficient & practical security. It's fast, pragmatic, and perfectly tailored to startups. The platform is seamless, the support outstanding, and the execution top-notch. We've evolved, saved time, and gained confidence, all while staying on budget. Truly game-changing
With Bastion, we transformed our security approach from ad-hoc processes to a fully structured, AI-aware SOC 2 compliance framework, all without slowing down AI development. Bastion's expertise in AI security and hands-on approach made compliance seamless
We started with a competitor but made no progress. Bastion provided real security expertise, hands-on support, and automation that truly reduced our workload, making the switch a no-brainer
Bastion didn't just give us a checklist, it gave us a dedicated security expert. Their GRC platform, security tools, hands-on approach and vCISO support made our compliance journey faster and stress-free
Bastion takes 'founder mode' to the next level. The team is incredibly reactive and always ready to help, ensuring everything runs smoothly. Their hands-on approach, efficiency, and deep understanding of startups make a real difference. Highly recommended!
Bastion delivers efficient & practical security. It's fast, pragmatic, and perfectly tailored to startups. The platform is seamless, the support outstanding, and the execution top-notch. We've evolved, saved time, and gained confidence, all while staying on budget. Truly game-changing
Bastion made it easy for us to collaborate and get audit-ready without slowing down product development
Bastion provided exceptional support every step of the way. The audit kicked off promptly, ran seamlessly, and returned with zero issues. The combination of the platform and expert guidance has saved us time and made a real impact. Truly impressive!