CVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commands
Bulletin ID: 2026-071-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 12:30 PM PDT Description: AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. We identified CVE-2026-18654, an issue where the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) disabled SSH host key verification, which might allow man-in-the-middle actors to intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint. Impacted versions: - AWS CLI v1 <= 1.45.27 - AWS CLI v2 <= 2.35.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
AI Analysis
Technical Summary
AWS CLI EMR helper commands disabled SSH host key verification, which is a critical security check to ensure the authenticity of the SSH server. This flaw affects the commands aws emr ssh, aws emr socks, aws emr put, and aws emr get, used to interact with EMR clusters. Disabling host key verification can allow man-in-the-middle attackers positioned on the network path to intercept or alter SSH sessions and file transfers. The vulnerability affects AWS CLI v1 versions up to 1.45.27 and v2 versions up to 2.35.2. AWS has fixed the issue in versions 1.45.28 and 2.35.3. No workaround exists because the insecure setting was hardcoded and not user-configurable.
Potential Impact
The vulnerability allows man-in-the-middle attackers to intercept SSH sessions and file transfers between the client and EMR cluster endpoints by exploiting disabled SSH host key verification. This compromises the confidentiality and integrity of data transmitted over these SSH connections. The impact is significant for users relying on these AWS CLI EMR helper commands for secure access and data transfer.
Mitigation Recommendations
AWS has released fixed versions of the AWS CLI: v1.45.28 and v2.35.3, which restore proper SSH host key verification. Users must upgrade to these versions or later to remediate the vulnerability. There is no workaround available because the insecure SSH option was hardcoded and cannot be overridden. Users should also ensure any forked or derivative code is updated to incorporate these fixes.
CVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commands
Description
Bulletin ID: 2026-071-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 12:30 PM PDT Description: AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. We identified CVE-2026-18654, an issue where the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) disabled SSH host key verification, which might allow man-in-the-middle actors to intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint. Impacted versions: - AWS CLI v1 <= 1.45.27 - AWS CLI v2 <= 2.35.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
AWS CLI EMR helper commands disabled SSH host key verification, which is a critical security check to ensure the authenticity of the SSH server. This flaw affects the commands aws emr ssh, aws emr socks, aws emr put, and aws emr get, used to interact with EMR clusters. Disabling host key verification can allow man-in-the-middle attackers positioned on the network path to intercept or alter SSH sessions and file transfers. The vulnerability affects AWS CLI v1 versions up to 1.45.27 and v2 versions up to 2.35.2. AWS has fixed the issue in versions 1.45.28 and 2.35.3. No workaround exists because the insecure setting was hardcoded and not user-configurable.
Potential Impact
The vulnerability allows man-in-the-middle attackers to intercept SSH sessions and file transfers between the client and EMR cluster endpoints by exploiting disabled SSH host key verification. This compromises the confidentiality and integrity of data transmitted over these SSH connections. The impact is significant for users relying on these AWS CLI EMR helper commands for secure access and data transfer.
Mitigation Recommendations
AWS has released fixed versions of the AWS CLI: v1.45.28 and v2.35.3, which restore proper SSH host key verification. Users must upgrade to these versions or later to remediate the vulnerability. There is no workaround available because the insecure SSH option was hardcoded and cannot be overridden. Users should also ensure any forked or derivative code is updated to incorporate these fixes.
Technical Details
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-071-aws/","fetched":true,"fetchedAt":"2026-08-03T19:46:19.078Z","wordCount":211}
- Classification
- {"confidence":0.88,"severitySource":"default","classifier":"rss-v2"}
Threat ID: 6a70f00bbf32cb7a341970db
Added to database: 08/03/2026, 19:46:19 UTC
Last enriched: 08/17/2026, 22:30:47 UTC
Last updated: 09/17/2026, 22:01:33 UTC
Views: 94
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.