CVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commands

Cli Emr ยท 2026-10-21

Actions

Rate this issue

Technical Details

Affected Versions 1.45.27, 2.35.2
Regions all
CVE IDs CVE-2026-18654
Migration Required Yes
Cost Impact Neutral

What This Means

For DevOps Teams

Update AWS CLI to versions 1.45.28 or 2.35.3 to resolve CVE-2026-18654, which disabled SSH host key verification in EMR helper commands, to prevent security vulnerabilities and ensure secure SSH sessions and file transfers.

For Platform Teams

Deploy the latest versions of AWS CLI to incorporate fixes for CVE-2026-18654, enhancing the security posture of EMR clusters by enabling SSH host key verification and protecting against potential man-in-the-middle attacks.

For Executives

Implement immediate upgrades to AWS CLI to address CVE-2026-18654 and mitigate security risks associated with disabled SSH host key verification in EMR helper commands, ensuring secure management of EMR clusters and protecting against potential man-in-the-middle attacks.

Source

View original AWS announcement โ†’

Related Cli Emr Updates

Weekly AWS Digest in Your Inbox

No spam, no headlines. Just a weekly summary of the 3โ€“7 AWS changes that matter for DevOps and Platform teams.

๐Ÿ“ง Exactly 1 email per week โ€ข Every Tuesday โ€ข Unsubscribe anytime

Today: AWS only. Coming next: Azure and other major clouds.