Executive brief
kas is a Python build system tool used in embedded Linux development environments. When set up with SSH credentials in CI/CD environments, the tool created a persistent SSH configuration file that disabled host key verification for all future SSH connections by the invoking user, even after kas completed its operation. This exposes users to man-in-the-middle attacks on subsequent SSH sessions unrelated to kas.
Technical details
This is a credential validation weakness (CWE-295) in kas's SSH integration. When kas initializes SSH keys via SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE variables and detects no pre-existing ~/.ssh/config, it creates one with a global Host * rule containing StrictHostKeyChecking no. This configuration persists after kas execution, permanently disabling SSH host authenticity verification for the invoking user. Attack vector is local with low privileges required and user interaction required (kas invocation). An attacker with network access can perform man-in-the-middle attacks against any subsequent SSH connections made by the affected user. The vulnerability affects all versions up to 5.3; it is patched in version 5.4. Users can mitigate by pre-creating their own ~/.ssh/config before invoking kas.
Affected products
- Siemens kas <= 5.3
Timeline
- 2026-06-24: disclosed
- 2026-06-24: patched: kas version 5.4
- 2026-08-26: advisory