Repository Signature Validation Weakness in kas Setup Tool from Siemens

CVE-2026-47192

What is CVE-2026-47192?

The kas setup tool, utilized for managing bitbake-based project configurations, presents a vulnerability linked to improper validation of repository signatures in versions 4.8 to 5.2. An attacker can exploit this weakness under specific circumstances to substitute a legitimate repository with one of their own, provided they have compromised a referenced repository. The attack necessitates that the victim's kas configuration includes a configuration file from the compromised repository, lacks a specified commit ID, and has specific key handling practices that weaken security. Patches have been implemented in version 5.3, and users are advised to secure their configurations by pinning signature keys via fingerprint.

References