CVE-2026-47191
Received Received - Intake

kas 5.3 Commit ID Validation Bypass via Branch Spoofing

Publication date: 2026-08-14

Last updated on: 2026-08-14

Assigner: GitHub, Inc.

Description
kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the referenced repository has been taken over by an attacker and modified to carry such a branch. SHA-1 commits may also be replaced by creating hash collisions, so the primary impact of this issue is on SHA-256 commit IDs. Version 5.3 fixes the issue. As a workaround, avoid relying solely on the commit ID for integrity validation of a repository that might become under control of a malicious 3rd party. If available, additional validate cryptographically signed commits or tags. Alternatively, mirror the repository to a save place, validate its integrity, and use this instead of the original one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-14
Last Modified
2026-08-14
Generated
2026-08-14
AI Q&A
2026-08-14
EPSS Evaluated
N/A
NVD
CVE-2026-47191
EUVD
EUVD-2026-58719

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
siemens kas to 5.3 (exc)
siemens kas 5.3

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-47191 is a vulnerability in the Siemens kas tool (versions prior to 5.3) that allows attackers to trick users into checking out a malicious branch with the same name as a valid commit ID (SHA-1 or SHA-256) from a compromised repository. The primary impact affects SHA-256 commit IDs, as SHA-1 commits can be replaced via hash collisions. The issue arises when users rely solely on commit IDs for integrity validation without additional checks.

Detection Guidance

To detect this vulnerability, check if your kas tool version is below 5.3. Run 'kas version' to verify. Inspect Git repositories for branches with SHA-like names (40 or 64 hex characters) using 'git branch -a'. Ensure commits are cryptographically signed or use tags for validation.

Commands: git ls-remote <repo-url> to list remote refs, git show-ref to check local refs, and git cat-file -t <sha> to verify object types.

Impact Analysis

This vulnerability could allow an attacker to replace a legitimate commit with a malicious branch of the same name, potentially leading to supply-chain attacks. Users may unknowingly check out and use compromised code, risking data integrity or system compromise. The impact is higher for SHA-256 commits due to stronger collision resistance in SHA-1.

Mitigation Strategies

Upgrade kas to version 5.3 or later. Avoid relying solely on commit IDs for integrity checks. Use cryptographically signed commits or tags. Mirror repositories to a trusted location and validate their integrity before use.

For Git operations, append '^{commit}' to SHA-like refs to force commit verification. Monitor repositories for unexpected branches with SHA-like names.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-47191. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart