# CVE-2026-47192: Siemens kas improper signature verification in repository processing

Source: https://junglewise.ai/threats/cve-2026-47192-siemens-kas-improper-signature-verification-in-repository  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-04. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2026-47192 · Severity: medium · CVSS 4 · Published 2026-06-04

Siemens kas, a setup tool for BitBake-based projects, contains a vulnerability where it processes repository configuration files before verifying their digital signatures. If an attacker gains control of a referenced repository, they could potentially manipulate the build configuration or replace security keys without detection. This could lead to the execution of unauthorized code or the use of compromised software components during the build process.

Technologies: [kas (PyPI)](https://junglewise.ai/threats/technologies/kas). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-47192 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-47192 being exploited in the wild.

**How severe is CVE-2026-47192?** Medium severity, with a CVSS score of 4, published 4 June 2026.

**Which products and versions are affected?** kas (PyPI) >= 4.8, < 5.3, ECOSYSTEM:introduced=4.8,fixed=5.3.

**Is there a fix for CVE-2026-47192?** Yes. kas (PyPI): upgrade to 5.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-47192 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-47192?** Check whether you run kas (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- kas (PyPI): upgrade to 5.3 or later

  ```sh
  pip install "kas>=5.3"
  ```


## Technical details

A signature validation vulnerability exists in Siemens kas (pip package) versions 4.8 through 5.2. The tool performs checkouts and processes configuration includes from repositories before validating their signatures (CWE-347). Under specific conditions—such as when a repository is referenced by tag without a commit ID, and the validation key is stored as a file without a pinned fingerprint—an attacker who has gained control of a referenced repository can modify the configuration to replace the expected signature key with one of their choosing. This allows for unnoticed repository manipulation. The issue is resolved in version 5.3 by ensuring validation occurs before processing.

## Affected products

- Siemens kas >= 4.8, < 5.3

## Identifiers

- CVE-2026-47192
- GHSA-4vqc-wpwg-vh7j
- PYSEC-2026-2543

## Timeline

- 2026-05-27: disclosed
- 2026-06-04: advisory: GitHub Advisory published
- 2026-05-27: patched: Fix released in version 5.3

## References

- [https://api.github.com/users/fmoessbauer](https://api.github.com/users/fmoessbauer)
- [https://github.com/fmoessbauer](https://github.com/fmoessbauer)
- [https://api.github.com/users/fmoessbauer/gists%7B/gist_id%7D](https://api.github.com/users/fmoessbauer/gists%7B/gist_id%7D)
- [https://api.github.com/users/fmoessbauer/repos](https://api.github.com/users/fmoessbauer/repos)
- [https://avatars.githubusercontent.com/u/9655545?v=4](https://avatars.githubusercontent.com/u/9655545?v=4)
- [https://api.github.com/users/fmoessbauer/events%7B/privacy%7D](https://api.github.com/users/fmoessbauer/events%7B/privacy%7D)

## Related threats

- [Siemens kas SSH host key checking configuration weakness](https://junglewise.ai/threats/cve-2026-54548-siemens-kas-ssh-host-key-checking-configuration-weakness)
- [Siemens kas improper verification of git commit IDs](https://junglewise.ai/threats/cve-2026-47191-siemens-kas-improper-verification-of-git-commit-ids)