Vulnerability · Published Aug 3, 2026 · Assigned by AMZN

CVE-2026-18654Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

Medium 6.8

In plain English

A medium-severity security flaw in aws-cli from AWS. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.5%top 59.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	awscli	1.45.28	GHSA-hqvf-45jj-mccq
PyPI	awscli	1.45.28	PYSEC-2026-3627

Affected products (as reported)

Vendor	Product	Versions
AWS	aws-cli	0 – through 1.45.270 – through 2.35.2

Weakness: CWE-322 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst patch, release-notes
https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst patch, release-notes
https://aws.amazon.com/security/security-bulletins/2026-071-aws/ vendor-advisory
https://github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccq release-notes