AWS CLI versions up to 1.45.27 (v1) and 2.35.2 (v2) contain a vulnerability in EMR SSH helper commands where SSH host key verification is disabled by passing StrictHostKeyChecking=no to the SSH client. This allows a network-positioned attacker to perform man-in-the-middle attacks on SSH sessions and file transfers between the client and EMR cluster instances, potentially exposing commands, files, and credentials. The issue is fixed in AWS CLI v1 1.45.28 and v2 2.35.3. No workaround exists as the insecure SSH option was hardcoded and not user-overridable.