CVE-2026-54548
Received Received - Intake

SSH Host Key Bypass in kas Setup Tool

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: GitHub, Inc.

Description
kas is a setup tool for bitbake based projects. Prior to 5.4, internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates ~/.ssh/config when no user-specific SSH configuration exists and adds a global Host * rule containing StrictHostKeyChecking no. In kas/libcmds.py, ssh_no_host_key_check() runs without checking ctx.managed_env, so the setting persists after kas exits and affects future SSH sessions by the same local user, extending beyond the intended short-lived continuous integration environment. A later SSH connection can therefore accept an attacker-controlled host key without verification, increasing the risk of a man-in-the-middle attack that compromises session confidentiality or integrity. This issue is fixed in version 5.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-54548
EUVD
EUVD-2026-66560

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects kas, a setup tool for bitbake projects. It allows an attacker to bypass SSH host key verification by creating a global SSH configuration that disables strict host key checking. This happens when kas sets up internal SSH keys without checking if the environment is managed, causing the setting to persist after kas exits and affect future SSH sessions.

Detection Guidance

Check for the presence of a ~/.ssh/config file with a global Host * rule containing StrictHostKeyChecking no. Inspect SSH configuration files for unexpected settings that disable host key verification.

Impact Analysis

An attacker could perform a man-in-the-middle attack during SSH connections, compromising session confidentiality or integrity. This risk is higher for users who rely on SSH for secure communications in CI environments or other automated workflows.

Mitigation Strategies

Upgrade kas to version 5.4 or later to fix the issue. Remove any manually added StrictHostKeyChecking no rules in ~/.ssh/config or system-wide SSH configurations. Verify SSH host key verification settings are correctly configured.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-54548. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart