CVE-2026-18654
Description
A flaw was found in AWS CLI. This vulnerability, located in the Elastic MapReduce (EMR) Secure Shell (SSH) helper commands, involves a lack of entity authentication during key exchange. A remote attacker, positioned between the client and the EMR cluster, could exploit this to intercept SSH sessions and file transfers, leading to information disclosure.
Statement
The AWS CLI disables SSH host key verification (StrictHostKeyChecking=no) when running the aws emr ssh, aws emr socks, aws emr put, and aws emr get subcommands against an Amazon EMR cluster. An attacker holding a machine-in-the-middle position on the network path between the client and the EMR node can impersonate the target host, causing information transmitted over the SSH session to be disclosed. Exploitation requires both interactive use of one of these EMR subcommands and an active MITM position, giving a high attack complexity; the vulnerable code is present in all shipped builds and is gated only by version (fixed in awscli 1.45.28 for the v1 line and awscli2 2.35.3 for the v2 line). Red Hat rates the impact of this flaw as Moderate. Red Hat products ship the affected command-line tool but do not invoke the EMR SSH helper subcommands as part of any product function, so the affected components are deferred.
Mitigation
Users who do not run the `aws emr ssh`, `aws emr socks`, `aws emr put`, or `aws emr get` subcommands are not exposed. Where these subcommands are required, verify the EMR node's SSH host key out-of-band before connecting, or restrict their use to trusted networks where a machine-in-the-middle attacker cannot intercept traffic. Upgrading to awscli 1.45.28 or later (v1 line) or awscli2 2.35.3 or later (v2 line) removes the vulnerable behavior.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.8 | N/A | 6.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Changed | N/A | Changed |
| Confidentiality | High | N/A | High |
| Integrity Impact | None | N/A | None |
| Availability Impact | None | N/A | None |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
cve.org: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
No authentication takes place in this process, bypassing an assumed protection of encryption.
Confidentiality
Technical Impact: Read Application Data
The encrypted communication between a user and a trusted host may be subject to sniffing by any actor in the communication path.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
