BastionGuard 2.0.2 Security Release Is Officially Available

BastionGuard 2.0.2 is now officially available as a security update for all supported Linux distributions.

This release addresses CVE-2026-XXXX, a high-severity local privilege-escalation vulnerability affecting the privileged bastionguard-firewall helper included in BastionGuard 2.0 and 2.0.1.

Severity

• CVSS v4.0: 8.5 High
• CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
• CWE: CWE-78 — Improper Neutralization of Special Elements used in an OS Command

All users running BastionGuard 2.0 or 2.0.1 should upgrade immediately.

Security issue

The affected firewall helper was previously installed with setuid-root permissions and processed firewall blacklist entries through a predictable temporary file.

The combination of insufficient input validation and shell-based command execution could allow an unprivileged local user to execute arbitrary commands with root privileges.

Security improvements in BastionGuard 2.0.2

• Setuid-root permissions have been removed from bastionguard-firewall.
• Privileged execution now requires authorization through pkexec.
• Shell-based firewall command execution has been eliminated.
• Firewall tools are executed with fixed paths and separate arguments.
• Every IPv4 and IPv6 entry is validated before use.
• Options, whitespace, shell syntax and unsupported input are rejected.
• Temporary files are generated, opened and verified securely.
• Symbolic-link and temporary-file replacement attacks are prevented.
• The correction is synchronized across all official package configurations.

BastionGuard 2.0.2 also hardens bastionguard-privhelper, used by the webcam and microphone privacy controls. It no longer relies on setuid-root permissions or shell-based command execution, and all application callers now request authorization through pkexec.

The bastionguard-privhelper changes are additional hardening and are not automatically part of CVE-2026-XXXX unless stated in the final CVE record.

Additional corrections

BastionGuard 2.0.2 includes all corrections previously released in BastionGuard 2.0.1, including the corrected ransomware real-time quarantine workflow.

Affected and fixed versions

Repository and package availability

All official BastionGuard repositories are fully synchronized, current and complete for every supported Linux distribution.

Only APKBUILD and ebuild files continue to be distributed through the BastionGuard download manager.