CVE-2026-18654

A flaw was found in AWS CLI. This vulnerability, located in the Elastic MapReduce (EMR) Secure Shell (SSH) helper commands, involves a lack of entity authentication during key exchange. A remote attacker, positioned between the client and the EMR cluster, could exploit this to intercept SSH sessions and file transfers, leading to information disclosure.

The AWS CLI disables SSH host key verification (StrictHostKeyChecking=no) when running the aws emr ssh, aws emr socks, aws emr put, and aws emr get subcommands against an Amazon EMR cluster. An attacker holding a machine-in-the-middle position on the network path between the client and the EMR node can impersonate the target host, causing information transmitted over the SSH session to be disclosed. Exploitation requires both interactive use of one of these EMR subcommands and an active MITM position, giving a high attack complexity; the vulnerable code is present in all shipped builds and is gated only by version (fixed in awscli 1.45.28 for the v1 line and awscli2 2.35.3 for the v2 line). Red Hat rates the impact of this flaw as Moderate. Red Hat products ship the affected command-line tool but do not invoke the EMR SSH helper subcommands as part of any product function, so the affected components are deferred.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Users who do not run the aws emr ssh, aws emr socks, aws emr put, or aws emr get subcommands are not exposed. Where these subcommands are required, verify the EMR node's SSH host key out-of-band before connecting, or restrict their use to trusted networks where a machine-in-the-middle attacker cannot intercept traffic. Upgrading to awscli 1.45.28 or later (v1 line) or awscli2 2.35.3 or later (v2 line) removes the vulnerable behavior.