kas, a tool for setting up BitBake projects, creates a global SSH configuration rule when no user‑specific configuration exists. During this process the tool writes "StrictHostKeyChecking no" into a newly created ~/.ssh/config. Because the rule remains in the configuration file after kas exits, any subsequent SSH session by the same local user inherits the disabled host key check, allowing an attacker who can control the remote SSH host key or server to mount a man‑in‑the‑middle attack without detection. The weakness is categorized as CWE‑295, an improper restriction of administrative attributes that permits manipulation of security‑critical settings.

The affected product is Siemens kas. All kas releases prior to version 5.4 are vulnerable. No specific sub‑version list is provided, but the issue is fixed in the 5.4 release and later, so any earlier deployment is at risk.

The CVSS score is 3.3, indicating low severity. EPSS data is unavailable and the vulnerability is not in the CISA KEV catalog, suggesting a low likelihood of exploitation. The attack vector is inferred to be local: it requires kas to run in a CI or user environment that subsequently initiates SSH connections. An attacker would need to control the remote SSH host or supply a malicious host key to benefit from the disabled host key verification. Therefore, while the vulnerability alone is not immediately dangerous, it can be leveraged to facilitate man‑in‑the‑middle attacks for attackers who can influence future SSH sessions made by the vulnerable user.