CVE-2026-18654: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint.
To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon AWS CLI v1to a version that resolves this vulnerability.Fixed in 1.45.28 - Upgrade
Upgrade
Amazon AWS CLI v2to a version that resolves this vulnerability.Fixed in 2.35.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18654?
The severity of CVE-2026-18654 is medium with a score of 6.8.
How do I fix CVE-2026-18654?
To fix CVE-2026-18654, upgrade to Amazon AWS CLI version 1.45.28 or AWS CLI v2 version 2.35.3 or later.
What is the impact of CVE-2026-18654?
CVE-2026-18654 allows man-in-the-middle attackers to intercept SSH sessions and file transfers due to disabled SSH host key verification in EMR SSH helper commands.
Which software is affected by CVE-2026-18654?
CVE-2026-18654 affects Amazon AWS CLI (EMR SSH helper commands) prior to version 1.45.28 and AWS CLI v2 prior to version 2.35.3.
When was CVE-2026-18654 published?
CVE-2026-18654 was published on August 3, 2026.