CVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commands

unknownCVE-2026-18654

Bulletin ID: 2026-071-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 12:30 PM PDT Description: AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. We identified CVE-2026-18654, an issue where the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) disabled SSH host key verification, which might allow man-in-the-middle actors to intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint. Impacted versions: - AWS CLI v1 <= 1.45.27 - AWS CLI v2 <= 2.35.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

Details

Source: AWS Security Bulletins (INTL · vendor-psirt · site)
Severity: unknown
Published: 2026-08-03
Exploitation: Not in CISA KEV at last sync

Original advisory: https://aws.amazon.com/security/security-bulletins/rss/2026-071-aws/

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-186540.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-18654	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

mediumCVE-2026-18654: Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI be…nvd

Recent advisories for - Disabled SSH

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-48113: Chisel is a TCP/UDP tunnel, transported over HTTP and secured via SSH. In versions prior to 1.…nvd · 2026-08-03
mediumCVE-2026-18654: Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI be…nvd · 2026-08-03
mediumCVE-2026-68930: Russh is a Rust SSH client & server library. Prior to 0.62.5, russh dispatches channel-scoped …nvd · 2026-08-03
highCVE-2026-56428: The SSH service on BSH ELP (Electronic Platform) modules contains a platform-specific vulnerab…nvd · 2026-07-30
mediumCVE-2026-44105: The credentials for the local user "user-app" may be exposed in log files, potentially enablin…nvd · 2026-07-30
highCVE-2026-14837: Multiple Lenze products are affected by an improper signature verification vulnerability in th…nvd · 2026-07-27