Read the docs
TI-2026-34779 Aliases CVE-2026-47191GHSA-qjwp-hrq6-r26r

kas checks out SHA-like git branches as valid commits

Priority LOW 11CWE-347Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Passive
Attack complexity
High
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-347.

Summary

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the referenced repository has been taken over by an attacker and modified to carry such a branch. SHA-1 commits may also be replaced by creating hash collisions, so the primary impact of this issue is on SHA-256 commit IDs. Version 5.3 fixes the issue. As a workaround, avoid relying solely on the commit ID for integrity validation of a repository that might become under control of a malicious 3rd party. If available, additional validate cryptographically signed commits or tags. Alternatively, mirror the repository to a save place, validate its integrity, and use this instead of the original one.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00246 15th percentileScored 2026-11-07
Fix Fixed kas (siemens): 5.3kas (PyPI): 5.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Siemenskasbefore 5.35.3Patch availableCNA
—kas (PyPI)before 5.35.3Patch availableGHSA-qjwp-hrq6-r26r
  • kas VendorSiemens Affected before 5.3 Fixed in 5.3 Patch available CNA
  • kas (PyPI) Vendor— Affected before 5.3 Fixed in 5.3 Patch available GHSA-qjwp-hrq6-r26r

Remediation

  • Fix · CNA kas (siemens) Fixed in 5.3
  • Fix · GHSA-qjwp-hrq6-r26r kas (PyPI) Fixed in 5.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47191
  2. 2026-10-03 Alias added: GHSA-qjwp-hrq6-r26r

References

Other 4

  • TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
  • TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
  • TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0
See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences