Vulnerability Description
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://aws.amazon.com/security/security-bulletins/2026-071-aws/
- https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst
- https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst
- https://github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccq
FAQ
What is CVE-2026-18654?
CVE-2026-18654 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions...
How severe is CVE-2026-18654?
CVE-2026-18654 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-18654?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.