TI-2026-39387 Aliases CVE-2026-54548 GHSA-mv8m-v9v6-5f94

kas: Persistent SSH Host Key Checking Disablement

LOW 15CWE-295Published 2026-08-26 · Updated 2026-08-26

Key facts

Attack vector: Local
Privileges required: Low
User interaction: Required
Attack complexity: High
Impact type: Spoofing
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-295.

Summary

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when no user-specific SSH configuration exists and adds a global Host * rule containing StrictHostKeyChecking no. In kas/libcmds.py, ssh_no_host_key_check() runs without checking ctx.managed_env, so the setting persists after kas exits and affects future SSH sessions by the same local user, extending beyond the intended short-lived continuous integration environment. A later SSH connection can therefore accept an attacker-controlled host key without verification, increasing the risk of a man-in-the-middle attack that compromises session confidentiality or integrity. This issue is fixed in version 5.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00112 1st percentileScored 2026-11-07

Fix Fixed kas (siemens): 5.4kas (PyPI): 5.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Siemens	kas	before 5.4	5.4	Patch available	CNA
—	kas (PyPI)	before 5.4	5.4	Patch available	GHSA-mv8m-v9v6-5f94

kas VendorSiemens Affected before 5.4 Fixed in 5.4 Patch available CNA
kas (PyPI) Vendor— Affected before 5.4 Fixed in 5.4 Patch available GHSA-mv8m-v9v6-5f94

Remediation

Fix · CNA kas (siemens) Fixed in 5.4
Fix · GHSA-mv8m-v9v6-5f94 kas (PyPI) Fixed in 5.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-54548
2026-10-03 Alias added: GHSA-mv8m-v9v6-5f94

References

Other 4

TI-2026-20057 Authentication bypass in Fortinet FortiWeb KEVCVSS 3.1CRITICAL 9.4
TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
TI-2025-18911 Heap-based buffer overflow in Fortinet FortiSwitchManager KEVCVSS 3.1CRITICAL 9.8
TI-2025-09686 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.8
TI-2022-07142 Code injection in Spring Framework KEVCVSS 3.1CRITICAL 9.8
TI-2021-19919 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints KEVCVSS 3.1CRITICAL 10.0

See all 2487 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences