Vulnerability in kas (CVE-2026-47192)
Summary
Vulnerability in kas (CVE-2026-47192). Risk of unauthorized operations or information disclosure. Exploitable via _source_dir. Mitigation: upgrade to 5.3 or later.
Original description
The description as published by the source.
kas is a setup tool for bitbake based projects. Starting in version 4.8 and prior to version 5.3, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions. First of all, the attacker must have gained control of a repository that a kas file of the victim is referencing. Furthermore, the following conditions must be fulfilled: the victim's kas configuration must include a configuration file from the attacked repository; the repository state is referenced by tag, and no commit ID is specified (this is triggering a warning, though); the key used for validating the tag or commit signature is stored as file in a repository; no fingerprint for the key is specified; and the _source_dir key must not be set by the victim when calling kas (e.g. by avoiding a local .config.yaml). Given these conditions, the attacker could modify the included kas configuration in way that the key used to validate the tag signature of the attacker's repository could be replaced by an attacker-chosen key. No other exploit possibilities have been identified so far, but this does not rule out that those may exist. All patches have been released along with kas version 5.3. As a workaround, pin the expected signature key via its fingerprint, also when storing it as file in a repository.
Source: GitHub Security Advisories (Global) NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-47192 has been found in kas.
Attackers can target a specific entry point like _source_dir over the network to misuse the product.
Risk of unauthorized operations or information disclosure.
What to do: upgrade kas to 5.3 or later.
If unsure, ask your IT team or search "kas CVE-2026-47192" on the vendor's site.
CVE-2026-47192 (kas) — CWE-347
Attack surface: _source_dir
Patched: 5.3 — apply immediately
Workaround: Pin the expected signature key via its fingerprint, also when storing it as file in a repository.
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
A vulnerability (CWE-347) exists in kas. Attackers reach the vulnerable code path via _source_dir.
Check the vendor advisory for the affected versions of kas. Attack surface: _source_dir.
Severity: ?. Risk of unauthorized operations or information disclosure.
Update to 5.3.
Workaround: Pin the expected signature key via its fingerprint, also when storing it as file in a repository.
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'kas' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'kas' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
kasを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
Pin the expected signature key via its fingerprint, also when storing it as file in a repository.パッチが適用されるまでの応急処置として、Pin the expected signature key via its fingerprint, also when storing it as file in a repository. を実施。回避策の副作用 (機能低下) を確認した上で。
-
3Apply patch patch
Upgrade kas to 5.3ステージング環境で 5.3 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-47192 kas
- Ubuntu UBUNTU-CVE-2026-47192 kas
References
- advisory github.com
- advisory github.com
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- package github.com
- patch github.com
- patch github.com
- web github.com