PT-2026-45483 · Debian+2 · Kas

Published 2026-06-01 · Updated 2026-06-02 · CVE-2026-47191

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions kas versions prior to 5.3

Description Users relying exclusively on a git commit ID (SHA-1 or SHA-256) to verify if a repository checkout matches a validated state in a kas configuration may be deceived into checking out a branch with the same name. This occurs if an attacker takes over the referenced repository and modifies it to include such a branch. While SHA-1 commits are susceptible to hash collisions, this issue primarily impacts SHA-256 commit IDs.

Recommendations Update to version 5.3. Avoid relying solely on the commit ID for integrity validation of repositories that could be controlled by a malicious third party. Validate cryptographically signed commits or tags if available. Mirror the repository to a secure location, validate its integrity, and use the mirror instead of the original repository.

Fix

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-47191

GHSA-QJWP-HRQ6-R26R

Affected Products

Kas

References · 9

• https://ubuntu.com/security/CVE-2026-47191 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-47191 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-47191 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2026-47191 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qjwp-hrq6-r26r · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-47191 · Vendor Advisory
• https://github.com/siemens/kas/security/advisories/GHSA-qjwp-hrq6-r26r · Note
• https://github.com/siemens/kas/commit/4cb4a3d01122ffaec9feaae768a5814092f6f9b5 · Note
• https://github.com/siemens/kas · Note