EUVD-2026-66560
GHSA-mv8m-v9v6-5f94
Severity by source
AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
Local vector because the misconfiguration requires local kas invocation; high complexity for the coinciding absence-of-config and SSH env var preconditions; low privileges as any local user can invoke kas.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when no user-specific SSH configuration exists and adds a global Host * rule containing StrictHostKeyChecking no. In kas/libcmds.py, ssh_no_host_key_check() runs without checking ctx.managed_env, so the setting persists after kas exits and affects future SSH sessions by the same local user, extending beyond the intended short-lived continuous integration environment. A later SSH connection can therefore accept an attacker-controlled host key without verification, increasing the risk of a man-in-the-middle attack that compromises session confidentiality or integrity. This issue is fixed in version 5.4.
AnalysisAI
SSH host key verification is persistently disabled in Siemens kas versions prior to 5.4 when the tool's internal SSH key setup path is triggered via SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE and the invoking user has no pre-existing ~/.ssh/config. The tool writes a global Host * rule with StrictHostKeyChecking no to ~/.ssh/config and does not remove it upon exit, leaving all subsequent SSH sessions of that local user silently accepting unverified host keys. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must coincide for exploitation: (1) the victim user must invoke kas with the SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE environment variable set, triggering kas's internal SSH host key checking suppression code path; (2) the user must have no pre-existing ~/.ssh/config at the time of invocation - if the file already exists, kas versions 2.6.3 and later will not modify it; (3) after kas exits, the user must initiate an SSH connection that an attacker can actively intercept via network MitM positioning. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.3 base score (AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) is a reasonable characterization of this vulnerability's constrained exploitation path. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to upgrade kas to version 5.4, which restricts the ssh_no_host_key_check() call to environments where ctx.managed_env is true (recognized CI environments), preventing persistent modification of developer ~/.ssh/config files. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-295 – Improper Certificate Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today