# CVE-2026-18654: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

> CVE-2026-18654: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands. CVSS 6.8 (CVSS 3.1).

Canonical: https://rewindex.com/cve/CVE-2026-18654
Last updated: 2026-10-23T21:10:00Z

- Published: 2026-08-03 19:38 UTC · Updated: 2026-10-23 21:10 UTC · Assigner: AMZN
- CVSS: 6.8 (CVSS 3.1) · Severity: Medium · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- EPSS: 0.46%, 40th percentile (scored 2026-10-25)
- CISA KEV: no
- CWE: CWE-322

## Description

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.

## Affected vendors and products

- AWS: aws-cli

## Tracked companies

- [Amazon Web Services](https://rewindex.com/company/aws.md)

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-18654)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-18654)
- [https://aws.amazon.com/security/security-bulletins/2026-071-aws/](https://aws.amazon.com/security/security-bulletins/2026-071-aws/)
- [https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst](https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst)
- [https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst](https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst)
- [https://github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccq](https://github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccq)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-18654 · Markdown: https://rewindex.com/cve/CVE-2026-18654.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-18654 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:15:32.740Z