CVE-2026-47191

描述

### Impact When relying solely on a git commit ID (SHA-1 or SHA-256) to qualify if a checkout of a repository is equivalent to the state validated while adding its commit ID to a kas configuration, users may be tricked to check out a branch of the same name from this repository. This implies that the referenced repository has been taken over by an attacker and modified to carry such a branch. SHA-1 commits may also be replaced by creating hash collisions, so the primary impact of this issue is on SHA-256 commit IDs. ### Patches Commit https://github.com/siemens/kas/commit/4cb4a3d01122ffaec9feaae768a5814092f6f9b5 is resolving this issue. It has been released along with kas version 5.3. ### Workarounds Avoid relying solely on the commit ID for integrity validation of a repository that might become under control of a malicious 3rd party. If available, additional validate cryptographically signed commits or tags. Alternatively, mirror the repository to a save place, validate its integrity, and use this instead of the original one. ### Credits That such issues exist was already reported 3 years ago by Aditya Sirish A Yelgundhalli. At this point, no strong integrity checks for external repositories were in place in kas, and Siemens stated in the kas documentation that such attacks are considered out of scope. This hasn't changed for SHA-1 commits as explained above. If a repo provides SHA-256 commits, though, those may be considered strong enough (even if not providing authenticity proof) and can be affected by this issue.

如何修補 CVE-2026-47191

要修補 CVE-2026-47191,請將受影響套件升級到下列已修補版本。

• —升級至 5.3 或更新版本
• —升級至 5.3 或更新版本

CVE-2026-47191 正在被利用嗎?

目前沒有被利用訊號。CVE-2026-47191 既不在 CISA KEV 也沒有最新的 EPSS 分數。

受影響套件(2)

• from 0, < 5.3
• from 0, < 5.3

CVSS 分數

參考連結(6)

• ADVISORYgithub.com/advisories/GHSA-qjwp-hrq6-r26r
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2026-47191
• PATCHgithub.com/siemens/kas
• PATCHpypi.org/project/kas
• WEBgithub.com