CVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commands
Cli Emr ยท 2026-10-21
Actions
Technical Details
| Affected Versions | 1.45.27, 2.35.2 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-18654 |
| Migration Required | Yes |
| Cost Impact | Neutral |
What This Means
For DevOps Teams
Update AWS CLI to versions 1.45.28 or 2.35.3 to resolve CVE-2026-18654, which disabled SSH host key verification in EMR helper commands, to prevent security vulnerabilities and ensure secure SSH sessions and file transfers.
For Platform Teams
Deploy the latest versions of AWS CLI to incorporate fixes for CVE-2026-18654, enhancing the security posture of EMR clusters by enabling SSH host key verification and protecting against potential man-in-the-middle attacks.
For Executives
Implement immediate upgrades to AWS CLI to address CVE-2026-18654 and mitigate security risks associated with disabled SSH host key verification in EMR helper commands, ensuring secure management of EMR clusters and protecting against potential man-in-the-middle attacks.
Source
Related Cli Emr Updates
- Amazon EMR on EKS now supports IPv6 Amazon EKS clusters (2026-09-23)
- Amazon EMR introduces Long Term Support with Apache Spark 4.1 (2026-09-22)
- Amazon EMR 7.14 is now available (2026-09-22)