Listen to this Post
kas is a setup tool for bitbake-based projects. Prior to version 5.4, a vulnerability existed in how the tool handles internal SSH key setup when triggered via the `SSH_PRIVATE_KEY` or `SSH_PRIVATE_KEY_FILE` environment variables.
When a user invokes kas with either of these variables set and no user-specific SSH configuration file (~/.ssh/config) exists, kas creates this file and adds a global `Host ` rule containing StrictHostKeyChecking no. This behavior was originally intended to ease the use of kas in short-lived CI environments that lack a pre-configured set of known hosts.
The root cause lies in the `ssh_no_host_key_check()` function within kas/libcmds.py, which runs without checking ctx.managed_env. As a result, the setting persists after kas exits and affects future SSH sessions made by the same local user. The scope of the issue extends far beyond the intended short-lived CI environment.
A later SSH connection made by the same user can therefore accept an attacker-controlled host key without verification. This increases the risk of a man-in-the-middle (MITM) attack that compromises session confidentiality or integrity.
The vulnerability carries a CVSS v3.1 base score of 3.3, classified as LOW severity. The attack vector is LOCAL, with HIGH attack complexity, LOW privileges required, and USER interaction required. The impact on confidentiality and integrity is LOW, with no impact on availability.
Such SSH configurations have been created since the very first public release of kas. The issue is addressed now by a commit that is part of kas version 5.4.
Since kas 2.6.3, a local user’s SSH configuration is only written if it didn’t exist before. From that version on, the issue can be avoided by creating an own `~/.ssh/config` prior to calling kas. If kas was already called, `~/.ssh/config` should be inspected and undesired settings created by kas should be removed.
DailyCVE Form:
Platform: Python (pypi:kas)
Version: < 5.4
Vulnerability: Improper Certificate Validation
Severity: LOW (CVSS 3.1)
date: 2026-08-26
Prediction: 2026-09-15
What Undercode Say:
Check if kas is installed and its version pip show kas | grep Version Check if ~/.ssh/config exists and contains the problematic rule cat ~/.ssh/config 2>/dev/null | grep -A1 "Host \" | grep "StrictHostKeyChecking no" Check for the presence of the vulnerable ssh_no_host_key_check function grep -r "ssh_no_host_key_check" /path/to/kas/libcmds.py 2>/dev/null List all kas versions installed in the environment pip list --all | grep kas
Exploit: (Educational Purposes!)
1. Attacker positions themselves as a man-in-the-middle between the victim and a target SSH server. 2. Victim runs kas with SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE set, and no ~/.ssh/config exists: SSH_PRIVATE_KEY="<key>" kas build 3. kas creates ~/.ssh/config with: echo -e "Host \n StrictHostKeyChecking no" > ~/.ssh/config 4. Later, victim connects via SSH to any host: ssh [email protected] 5. Because StrictHostKeyChecking is disabled, the SSH client accepts any host key presented by the attacker without verification. The attacker can now intercept, decrypt, and modify the SSH session.
Protection:
- Upgrade kas to version 5.4 or later immediately.
- If running kas 2.6.3 or later, create an empty `~/.ssh/config` file prior to invoking kas to prevent the tool from writing the vulnerable configuration.
- Inspect existing `~/.ssh/config` and remove any `StrictHostKeyChecking no` entries added by kas.
- Consider using `~/.ssh/known_hosts` with pre-verified host keys instead of disabling host key checking.
- In CI environments, ensure SSH configurations are managed explicitly and not left to implicit tool behavior.
Impact:
- Confidentiality: An attacker can intercept and read SSH session data.
- Integrity: An attacker can modify data in transit.
- Availability: No direct impact on availability.
- Scope: The setting persists beyond the kas command lifetime, affecting all future SSH connections by the same user.
- Attack Vector: Local access required; attacker needs an authenticated session or local user account.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
