CVE-2026-54548: CWE-295: Improper Certificate Validation in siemens kas

In kas versions before 5.4, the internal SSH key setup triggered by SSH_PRIVATE_KEY or SSH_PRIVATE_KEY_FILE creates a ~/.ssh/config file with a global 'Host *' rule that sets 'StrictHostKeyChecking no' if no user-specific SSH configuration exists. The function ssh_no_host_key_check() does not verify the context's managed environment, causing this insecure setting to persist after kas exits and affect future SSH sessions by the same user. This improper certificate validation increases the risk of man-in-the-middle attacks compromising session confidentiality and integrity. The vulnerability is addressed in kas version 5.4.

The vulnerability allows an attacker to bypass SSH host key verification for all subsequent SSH connections by the affected user, increasing the risk of man-in-the-middle attacks that can compromise confidentiality and integrity of SSH sessions. The CVSS score is 3.3 (low), reflecting limited impact and attack complexity requiring local access and user interaction.

This issue is fixed in kas version 5.4. Users should upgrade to version 5.4 or later to resolve this vulnerability. No other official remediation or temporary fixes are documented. Until upgraded, users should manually inspect and remove any global 'StrictHostKeyChecking no' settings in their ~/.ssh/config to prevent insecure SSH behavior.