CVE-2026-54548

kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSHPRIVATEKEY or SSHPRIVATEKEYFILE creates ~/.ssh/config when no user-specific SSH configuration exists and adds a global Host * rule containing StrictHostKeyChecking no. In kas/libcmds.py, sshnohostkeycheck() runs without checking ctx.managedenv, so the setting persists after kas exits and affects future SSH sessions by the same local user, extending beyond the intended short-lived continuous integration environment. A later SSH connection can therefore accept an attacker-controlled host key without verification, increasing the risk of a man-in-the-middle attack that compromises session confidentiality or integrity. This issue is fixed in version 5.4.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/54xxx/CVE-2026-54548.json",
    "cwe_ids": [
        "CWE-295"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/siemens/kas

Affected ranges

Type

GIT

Repo

https://github.com/siemens/kas

Events

Introduced

Fixed

1c1e861c9f241ce082b86bef6bedc7da9b676294

Fixed

81bab5294be29de4b64adedce962d36184bfc66f

Database specific

Show details

{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "5.4"
        }
    ]
}

Affected versions

0.*

0.10.0

0.11.0

0.12.0

0.13.0

0.14.0

0.15.0

0.16.0

0.16.1

0.17.0

0.18.0

0.19.0

0.20.0

0.20.1

0.9.0

1.*

1.0

1.1

2.*

2.0

2.1

2.1.1

2.2

2.3

2.3.1

2.3.2

2.3.3

2.4

2.5

2.6

2.6.1

2.6.2

2.6.3

3.*

3.0

3.0.1

3.0.2

3.1

3.2

3.2.1

3.2.2

3.2.3

3.3

4.*

4.0

4.1

4.2

4.3

4.3.1

4.3.2

4.4

4.5

4.6

4.7

4.8

4.8.1

4.8.2

5.*

5.0

5.1

5.2

5.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-54548.json"