CVE-2026-18654
Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
- State
- Published
- Severity
- 6.9 Medium
- Published
- Aug 3, 2026
- Updated
- Aug 4, 2026
- Reserved
- Aug 3, 2026
Description
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint.
To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N | AMZN |
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N | AMZN |
Weaknesses
- CWE-322 Key exchange without entity authentication
Affected Products
| Product | Versions |
|---|---|
aws-cliAWS |
|
References
- https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rstpatchrelease-notes
- https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rstpatchrelease-notes
- https://aws.amazon.com/security/security-bulletins/2026-071-aws/vendor-advisory
- https://github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccqrelease-notes
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.