Siemens kas up to 5.2 Signature Validation _source_dir state issue

Summaryinfo

A vulnerability, which was classified as critical, was found in Siemens kas up to 5.2. The impacted element is an unknown function of the component Signature Validation. Such manipulation of the argument _source_dir leads to state issue. This vulnerability is documented as CVE-2026-47192. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Siemens kas up to 5.2 and classified as critical. Affected by this issue is some unknown functionality of the component Signature Validation. The manipulation of the argument _source_dir with an unknown input leads to a state issue vulnerability. Using CWE to declare the problem leads to CWE-371. Impacted is confidentiality, integrity, and availability. CVE summarizes:

kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions. First of all, the attacker must have gained control of a repository that a kas file of the victim is referencing. Furthermore, the following conditions must be fulfilled: the victim's kas configuration must include a configuration file from the attacked repository; the repository state is referenced by tag, and no commit ID is specified (this is triggering a warning, though); the key used for validating the tag or commit signature is stored as file in a repository; no fingerprint for the key is specified; and the `_source_dir` key must not be set by the victim when calling kas (e.g. by avoiding a local `.config.yaml`). Given these conditions, the attacker could modify the included kas configuration in way that the key used to validate the tag signature of the attacker's repository could be replaced by an attacker-chosen key. No other exploit possibilities have been identified so far, but this does not rule out that those may exist. All patches have been released along with kas version 5.3. As a workaround, pin the expected signature key via its fingerprint, also when storing it as file in a repository.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-47192 since 05/19/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/14/2026).

Upgrading to version 5.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Siemens

Name

• kas

Version

• 5.0
• 5.1
• 5.2

License

• commercial

Website

• Vendor: https://www.siemens.com/
• Product: https://github.com/siemens/kas/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion