CVE-2026-18654

Description

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.

References

https://aws.amazon.com/security/security-bulletins/2026-071-aws/

https://github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccq

https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst

https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

CVSS v4

EPSS