Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when no user-specific SSH configuration exists and adds a global Host * rule containing StrictHostKeyChecking no. In kas/libcmds.py, ssh_no_host_key_check() runs without checking ctx.managed_env, so the setting persists after kas exits and affects future SSH sessions by the same local user, extending beyond the intended short-lived continuous integration environment. A later SSH connection can therefore accept an attacker-controlled host key without verification, increasing the risk of a man-in-the-middle attack that compromises session confidentiality or integrity. This issue is fixed in version 5.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-26 | 1 | General1 |
| 2026-08-30 | 2 | Disclosure2 |
| 2026-09-12 | 1 | Disclosure1 |
CVE-2026-54548 kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when n… https://www.cve.org/CVERecord?id=CVE-2026-54548
Post summary
The text reports a CVE involving the creation of an SSH config file during internal key setup in kas, but it does not provide a PoC, exploit details, or patch information.
A little late in sharing this, but happy to announce that I was assigned CVE-2026-54548 for a vulnerability I discovered and responsibly disclosed. The issue has since been fixed. 🔗 Advisory: https://github.com/advisories/GHSA-mv8m-v9v6-5f94
Post summary
The author announces that they discovered and responsibly disclosed CVE‑2026‑54548, the issue has since been fixed, and they provide a link to the advisory.
🚨*CVE* CVE-2026-54548 kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when n… https://www.cve.org/CVERecord?id=CVE-2026-54548 ----- Traducción: CVE-2026-54548 kas… https://infoflow.cloud`
Post summary
The post references CVE‑2026‑54548, noting a vulnerability in the kas setup tool that creates an SSH config when certain environment variables are set, but provides no PoC, exploit, or patch information.
🔵 kas (Siemens), Improper Certificate Validation, #CVE-2026-54548 (LOW) -DC-Aug2026-1935 https://dailycve.com/kas-siemens-improper-certificate-validation-cve-2026-54548-low-dc-aug2026-1935/
Post summary
The post announces CVE‑2026‑54548 for Siemens KAS, describing an improper certificate validation issue but provides no evidence of exploitation, PoC, or mitigation.