CVE-2026-18654

mediumCVSS 6.8covered by 2 sourcesfirst seen 2026-08-03

Bulletin ID: 2026-071-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 12:30 PM PDT Description: AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. We identified CVE-2026-18654, an issue where the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) disabled SSH host key verification, which might allow man-in-the-middle actors to intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint. Impacted versions: - AWS CLI v1 <= 1.45.27 - AWS CLI v2 <= 2.35.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.

⚡ Watch CVE-2026-18654

Get an email if CVE-2026-18654 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.29% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.

Advisory coverage (2)

mediumCVE-2026-18654: Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI be…nvd · 2026-08-03
unknownCVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commandsaws · 2026-08-03

External references

NVD record for CVE-2026-18654

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-18654 status](https://www.csirts.com/badge/CVE-2026-18654)](https://www.csirts.com/cve/CVE-2026-18654)