CVE-2026-54548: 
Python vulnerability analysis and mitigation

CVE-2026-54548 is a vulnerability in Siemens' kas (Kconfig-based Application System) build tool that causes persistent disablement of SSH host key checking for the invoking user. When SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE environment variables trigger internal SSH key setup and no user-specific SSH configuration file exists, kas creates ~/.ssh/config with a global Host * rule setting StrictHostKeyChecking no. This configuration persists beyond the lifetime of the kas command, increasing the risk of man-in-the-middle (MitM) attacks against future SSH connections. All versions up to and including 5.3 are affected; version 5.4 contains the fix. The vulnerability carries a CVSS v3.1 base score of 3.3 (Low) (GitHub Advisory).

The root cause is classified as CWE-295 (Improper Certificate Validation) — specifically, the improper handling of SSH host authenticity verification. When kas sets up SSH keys via SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE and no ~/.ssh/config exists for the invoking user, it creates one with a global Host * stanza containing StrictHostKeyChecking no. This was originally intended to simplify use in ephemeral CI environments lacking pre-configured known hosts, but the resulting configuration file persists on the filesystem after kas exits, affecting all subsequent SSH connections made by that user. Since kas version 2.6.3, the SSH config is only written if it did not previously exist, limiting but not eliminating the exposure (GitHub Advisory).

The primary impact is a weakening of SSH host authenticity verification that extends beyond the scope and lifetime of the kas invocation. Any future SSH connections made by the affected user — including to production systems, source code repositories, or remote servers — will not verify host keys, making them susceptible to man-in-the-middle attacks. This could result in credential interception, session hijacking, or exposure of sensitive data transmitted over SSH. The confidentiality and integrity impacts are rated Low, and there is no direct availability impact (GitHub Advisory).

Exploitation requires local access, high attack complexity, low privileges, and user interaction, resulting in a low overall exploitability rating. No public proof-of-concept exploit code, active in-the-wild exploitation, or threat actor attribution has been reported. The CVE ID was reserved and the advisory was published on June 24, 2026. There is no indication this vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no EPSS score data is currently available (GitHub Advisory).

1. Identify a target user: Determine that a local user has invoked kas with SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE set, and that no ~/.ssh/config existed for that user prior to the kas invocation.
2. Confirm persistent misconfiguration: Verify that ~/.ssh/config now contains a Host * block with StrictHostKeyChecking no, created by kas.
3. Position for MitM attack: Using network-level access (e.g., ARP spoofing, DNS poisoning, or rogue Wi-Fi), position an attacker-controlled host to intercept SSH connections made by the affected user.
4. Intercept SSH session: When the user initiates an SSH connection to a legitimate server, the attacker's host presents a forged or substituted SSH host key. Because StrictHostKeyChecking no is set, the SSH client accepts the key without warning.
5. Capture credentials or data: The attacker can now relay or inspect the SSH session, capturing credentials, commands, or sensitive data transmitted by the user (GitHub Advisory).

• File System: Presence of ~/.ssh/config containing a Host * block with StrictHostKeyChecking no for users who have invoked kas — especially if the user did not intentionally create this file.
• File System: Unexpected or recently created ~/.ssh/config files on systems where kas is used in CI/CD pipelines or developer workstations.
• Logs: SSH client logs or audit logs showing connections to unexpected hosts without host key verification warnings, which may indicate MitM interception is occurring silently.

Upgrade kas to version 5.4, which addresses the issue by no longer creating a globally permissive SSH configuration. As a workaround for users on kas 2.6.3 or later, create a ~/.ssh/config file manually before invoking kas — this prevents kas from overwriting it. If kas has already been invoked and the file was created, inspect ~/.ssh/config and remove any Host * block containing StrictHostKeyChecking no that was introduced by kas. Organizations using kas in CI/CD pipelines should audit runner environments for this misconfiguration (GitHub Advisory).

The vulnerability was reported by security researcher shubtheone and published by jan-kiszka (a Siemens maintainer) on June 24, 2026, via GitHub's security advisory system. No significant broader media coverage or notable community discussion beyond the advisory itself has been identified at this time (GitHub Advisory).