CVE-2026-47191

CVE-2026-47191 affects the kas setup tool for BitBake-based projects. Before version 5.3, reliant on a git commit ID (SHA-1/SHA-256) to validate repository state could mislead users into checking out a branch with the same name, potentially indicating a repository takeover. The primary impact con...

CVE-2026-47191 kas checks out SHA-like git branches as valid commits

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

CVE-2026-47191 kas checks out SHA-like git branches as valid commits

kas is a setup tool for bitbake based projects. Prior to version 5.3, when relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch...

GO-2026-5013 vulnerabilities

Vulnerabilities for packages: guac, grype, ko, witness, prometheus, syft, crossplane-provider-aws-route53, spire-server, fulcio, neuvector-sigstore-interface, docker-compose, hcloud, wal-g, loki, step-kms-plugin, crossplane-provider-aws-sns, crossplane-provider-keycloak, trivy-operator, tkn,...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: bonding: Fixed a use-after-free in bondxmitbroadcast. bondxmitbroadcast reuses the original skb for the last slave determined by bondislastslave and clones it for others. Concurrent slave enslave/release operations may mutat...

SUSE CVE-2026-64411

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: terminate table name before findtablelock updatecounters and compatupdatecounters forward a user-supplied 32-byte table name to findtablelock without NUL-terminating it. On a lookup miss, findinlistlock calls...

PYSEC-2026-2543 kas's late signature validation may allow unnoticed repository manipulations

Impact So far, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions. First of all, the attacker mus...

kas's late signature validation may allow unnoticed repository manipulations

ImpactSo far, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions.First of all, the attacker must...

PYSEC-2026-2544 kas checks out SHA-like git branches as valid commits

Impact When relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the...

PT-2026-59201

Impact So far, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions. First of all, the attacker mus...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: reports-server, knative-kafka-broker, k3s, cloudbeat, commercial-expanso-edge, external-dns, keda-fips, frankenphp-8.3, gitlab-kas, terraform, chisel-fips, external-secrets-operator-fips, grafana, etcd-fips, kyverno-fips, argocd-image-updater, flux-source-controller,...

GHSA-W879-237Q-WC7R vulnerabilities

Vulnerabilities for packages: guac, grype, ko, witness, prometheus, syft, spire-server, fulcio, neuvector-sigstore-interface, hcloud, wal-g, loki, step-kms-plugin, trivy-operator, tkn, argocd-image-updater, fscrypt, helm, external-dns, prometheus-operator, kine, skaffold, policy-controller,...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: knative-serving, minio, cert-manager, nerdctl, kaf, kyverno, flux, mattermost, opentelemetry-collector, prometheus, cloud-provider-aws, zot, kubescape, spire-server, gitlab-kas, telegraf, cilium-cli, rancher, aactl, loki, snyk-cli, cilium, k3s, trivy-operator, fscryp...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: guac, grype, witness, prometheus, syft, spire-server, loki, step-kms-plugin, trivy-operator, argocd-image-updater, fscrypt, helm, external-dns, prometheus-operator, kine, skaffold, osv-scanner, kubernetes-dashboard, external-secrets-operator, nuclei, pulumi,...

GHSA-JPPX-RXG9-JMRX vulnerabilities

Vulnerabilities for packages: knative-serving, minio, cert-manager, nerdctl, kaf, kyverno, flux, mattermost, opentelemetry-collector, prometheus, cloud-provider-aws, zot, spire-server, gitlab-kas, telegraf, cilium-cli, rancher, aactl, loki, snyk-cli, cilium, k3s, fscrypt, helm, podman,...

kas's late signature validation may allow unnoticed repository manipulations

Impact So far, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions. First of all, the attacker mus...

PT-2026-46846

Impact So far, kas checks out and processes repositories regarding configuration includes prior to validating signatures of those repositories. This may allow to replace on original repository with one under the control of an attacker under very specific conditions. First of all, the attacker mus...

Improper Verification of Cryptographic Signature

Overview kas is a Setup tool for bitbake based projects Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the process of checking out git repositories using commit IDs. An attacker can cause users to check out a malicious branch by creating a...

kas checks out SHA-like git branches as valid commits

Impact When relying solely on a git commit ID SHA-1 or SHA-256 to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the...

PT-2026-45483

Name of the Vulnerable Software and Affected Versions kas versions prior to 5.3 Description Users relying exclusively on a git commit ID SHA-1 or SHA-256 to verify if a repository checkout matches a validated state in a kas configuration may be deceived into checking out a branch with the same...