Threats Tagged 'cwe-322'

Bulletin ID: 2026-071-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 12:30 PM PDT Description: AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. We identified CVE-2026-18654, an issue where the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) disabled SSH host key verification, which might allow man-in-the-middle actors to intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint. Impacted versions: - AWS CLI v1 <= 1.45.27 - AWS CLI v2 <= 2.35.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

The Apache Airflow Git provider runs its git-over-SSH operations with `StrictHostKeyChecking=no` by default, disabling SSH host-key verification. An attacker who can intercept the network path between an Airflow worker and the Git server can impersonate the server (man-in-the-middle), capturing the SSH deploy key or injecting malicious repository content. Deployments that use the Git DAG bundle or Git provider to clone over SSH with a deploy key are affected. The fix changes the default to verify host keys; upgrade to apache-airflow-providers-git `0.4.1` or later and configure a `known_hosts` file.

A vulnerability has been identified in centraldogma-server-mirror-git versions prior to 0.84.0, where the Git mirror SSH client does not verify remote host keys for git+ssh:// connections, allowing an on-path attacker to perform man-in-the-middle attacks and compromise mirrored repositories.

Apache Airflow Google provider versions before 22.0.0 have a vulnerability in the ComputeEngineSSHHook where SSH host-key verification is disabled by default. This exposes SSH traffic between Airflow workers and Compute Engine VMs to interception or modification by in-path attackers. Users are advised to upgrade to version 22.0.0 or later to address this issue.

The Claude Desktop app gives you Claude Code with a graphical interface built for running multiple sessions side by side. From 1.2581.0 to before 1.4304.0, Claude Desktop's SSH remote development feature verified only whether a hostname existed in ~/.ssh/known_hosts without comparing the server's presented host key against the stored key. This allowed a network-positioned attacker to present an arbitrary SSH host key and have the connection silently accepted, enabling a man-in-the-middle attack on remote development sessions. Successful exploitation required the attacker to be in a network position to intercept SSH traffic (e.g., via ARP spoofing, rogue Wi-Fi, or DNS poisoning) and the target hostname to already have an entry in the victim's known_hosts file. This vulnerability is fixed in 1.4304.0.

Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a device with the motorcycle via Bluetooth. Once paired, an attacker can utilize over-the-air firmware updating functionality to potentially upload malicious firmware to the motorcycle. The motorcycle must first be in Bluetooth pairing mode, and the attacker must be in proximity of the vehicle and understand the full pairing process, to be able to pair their device with the vehicle. The attacker's device must remain paired with and in proximity of the motorcycle for the entire duration of the firmware update.

Juniper Networks Apstra versions before 6.1.1 contain a vulnerability in their SSH implementation where key exchange occurs without proper entity authentication. This flaw allows an unauthenticated attacker to perform a man-in-the-middle attack by impersonating managed devices. The attacker can intercept SSH connections from Apstra to managed devices, potentially capturing user credentials. The vulnerability is identified as CWE-322 and has a high severity rating with a CVSS score of 8.7.

CVE-2026-33697 is a high-severity vulnerability in the attested TLS (aTLS) implementation of the CoCoS confidential computing system for AI, affecting versions 0.4.0 through 0.8.2. The vulnerability allows a relay attack due to the extraction of the ephemeral TLS private key during the intra-handshake attestation. This key extraction enables an attacker to impersonate an attested CoCoS service, undermining authentication guarantees and potentially exposing sensitive data or operations. Exploitation requires physical access or advanced side-channel or transient execution attacks. The vulnerability is architectural and affects both AMD SEV-SNP and Intel TDX deployments. No patch or complete workaround is currently available, though some hardening measures can reduce risk.

A critical authentication bypass vulnerability (CVE-2026-1709) exists in Keylime, a TPM-based remote boot attestation and runtime integrity measurement solution. The issue arises from missing client-side TLS authentication, allowing unauthorized administrative operations. This vulnerability affects Keylime packages distributed with Red Hat Enterprise Linux 10 across multiple architectures. Red Hat has issued a security update to address this flaw.

SSH Hostkey misconfiguration vulnerability in TP-Link Archer AX53 v1.0 (tmpserver modules) allows attackers to obtain device credentials through a specially crafted man‑in‑the‑middle (MITM) attack. This could enable unauthorized access if captured credentials are reused.This issue affects Archer AX53 v1.0: through 1.3.1 Build 20241120.

HighVulnerabilityUnited StatesChinaGermany+11#cve#cve-2025-62501#cwe-322