CVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commands
Bulletin ID: 2026-071-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 12:30 PM PDT Description: AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. We identified CVE-2026-18654, an issue where the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) disabled SSH host key verification, which might allow man-in-the-middle actors to intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint. Impacted versions: - AWS CLI v1 <= 1.45.27 - AWS CLI v2 <= 2.35.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
AI Analysis
Technical Summary
AWS CLI EMR helper commands disabled SSH host key verification, which could allow man-in-the-middle attackers to intercept SSH sessions and file transfers. The affected commands are aws emr ssh, aws emr socks, aws emr put, and aws emr get. This vulnerability affects AWS CLI v1 versions up to 1.45.27 and AWS CLI v2 versions up to 2.35.2. The issue has been resolved in AWS CLI v1.45.28 and AWS CLI v2.35.3. No workaround exists because the insecure SSH option was hardcoded and could not be overridden by users. Users must upgrade to the fixed versions to mitigate the risk.
Potential Impact
The vulnerability disables SSH host key verification in specific AWS CLI EMR helper commands, which may allow attackers positioned between the client and EMR cluster endpoint to intercept SSH sessions and file transfers. This compromises the confidentiality and integrity of data transmitted during these operations.
Mitigation Recommendations
Upgrade AWS CLI to version 1.45.28 or later for v1, or 2.35.3 or later for v2. There is no workaround because the insecure SSH option was hardcoded and cannot be overridden. Ensure any forked or derivative code is also updated to incorporate the fix.
CVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commands
Description
Bulletin ID: 2026-071-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 12:30 PM PDT Description: AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. We identified CVE-2026-18654, an issue where the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) disabled SSH host key verification, which might allow man-in-the-middle actors to intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint. Impacted versions: - AWS CLI v1 <= 1.45.27 - AWS CLI v2 <= 2.35.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
AWS CLI EMR helper commands disabled SSH host key verification, which could allow man-in-the-middle attackers to intercept SSH sessions and file transfers. The affected commands are aws emr ssh, aws emr socks, aws emr put, and aws emr get. This vulnerability affects AWS CLI v1 versions up to 1.45.27 and AWS CLI v2 versions up to 2.35.2. The issue has been resolved in AWS CLI v1.45.28 and AWS CLI v2.35.3. No workaround exists because the insecure SSH option was hardcoded and could not be overridden by users. Users must upgrade to the fixed versions to mitigate the risk.
Potential Impact
The vulnerability disables SSH host key verification in specific AWS CLI EMR helper commands, which may allow attackers positioned between the client and EMR cluster endpoint to intercept SSH sessions and file transfers. This compromises the confidentiality and integrity of data transmitted during these operations.
Mitigation Recommendations
Upgrade AWS CLI to version 1.45.28 or later for v1, or 2.35.3 or later for v2. There is no workaround because the insecure SSH option was hardcoded and cannot be overridden. Ensure any forked or derivative code is also updated to incorporate the fix.
Technical Details
- Article Source
- {"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-071-aws/","fetched":true,"fetchedAt":"2026-08-03T19:46:19.078Z","wordCount":211}
Threat ID: 6a70f00bbf32cb7a341970db
Added to database: 08/03/2026, 19:46:19 UTC
Last enriched: 08/03/2026, 19:46:26 UTC
Last updated: 08/03/2026, 23:47:05 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.