Executive brief
Siemens kas, a setup tool for BitBake-based projects, contains a vulnerability where it processes repository configuration files before verifying their digital signatures. If an attacker gains control of a referenced repository, they could potentially manipulate the build configuration or replace security keys without detection. This could lead to the execution of unauthorized code or the use of compromised software components during the build process.
Technical details
A signature validation vulnerability exists in Siemens kas (pip package) versions 4.8 through 5.2. The tool performs checkouts and processes configuration includes from repositories before validating their signatures (CWE-347). Under specific conditions—such as when a repository is referenced by tag without a commit ID, and the validation key is stored as a file without a pinned fingerprint—an attacker who has gained control of a referenced repository can modify the configuration to replace the expected signature key with one of their choosing. This allows for unnoticed repository manipulation. The issue is resolved in version 5.3 by ensuring validation occurs before processing.
Affected products
- Siemens kas >= 4.8, < 5.3
Timeline
- 2026-05-27: disclosed
- 2026-06-04: advisory: GitHub Advisory published
- 2026-05-27: patched: Fix released in version 5.3