Description
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint.



To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
Published: 2026-08-03
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Key exchange performed by the EMR SSH helper commands in Amazon AWS CLI lacks entity authentication. The vulnerability allows a man‑in‑the‑middle attacker positioned between the client and the EMR cluster to intercept SSH sessions and file transfers. The weakness rests on CWE‑322, which is an authentication bypass affecting confidentiality of data in transit.

Affected Systems

AWS customers using the AWS Command Line Interface v1 before 1.45.28 or v2 before 2.35.3 are affected. The issue is present in all previous releases of the CLI that support EMR SSH helper commands.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate impact risk. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The likely attack vector requires an attacker to place themselves on the network path between the client and the EMR cluster endpoint. Successful exploitation would allow interception of encrypted SSH traffic, enabling credential theft or data tampering.

Generated by OpenCVE AI on August 4, 2026 at 09:53 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade AWS CLI to version v1 1.45.28 or later, or to v2 2.35.3 or later, to obtain host key verification in the EMR helper commands.
  • If an immediate upgrade is not possible, restrict network traffic to the EMR cluster endpoint to trusted, monitored paths to reduce the opportunity for a MITM attack.
  • Avoid using EMR SSH helper commands that bypass host key verification until a patched version is available.

Generated by OpenCVE AI on August 4, 2026 at 09:53 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-hqvf-45jj-mccq AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
History

Tue, 04 Aug 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 03 Aug 2026 20:15:00 +0000

Type Values Removed Values Added
Description Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
Title Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
First Time appeared Aws
Aws aws-cli
Weaknesses CWE-322
CPEs cpe:2.3:a:aws:aws-cli:*:*:*:*:*:*:*:*
Vendors & Products Aws
Aws aws-cli
References
Metrics cvssV3_1

{'score': 6.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}

Subscriptions

Aws Aws-cli
cve-icon MITRE

Status: PUBLISHED

Assigner: AMZN

Published:

Updated: 2026-08-04T19:32:59.576Z

Reserved: 2026-08-03T13:07:41.422Z

Link: CVE-2026-18654

cve-icon Vulnrichment

Updated: 2026-08-04T19:32:44.803Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-08-03T20:17:17.383

Modified: 2026-08-04T20:16:50.257

Link: CVE-2026-18654

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-04T10:00:04Z

Weaknesses
  • CWE-322

    Key Exchange without Entity Authentication