CVE-2026-18654

The record

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.

Affected packages

Related vulnerabilities

• CVE-2026-94423 Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because… CWE-322
• CVE-2026-94140 Rex versions through 1.16.1 for Perl accept an unknown SSH host key for remote rsync… CWE-322
• CVE-2026-107675 FFmpeg through 9.0.2 contains a missing host key verification vulnerability in the… CWE-322
• CVE-2026-11745 A vulnerability has been identified in centraldogma-server-mirror-git versions prior to… CWE-322
• CVE-2026-45361 Apache Airflow providers-google's `ComputeEngineSSHHook` disables SSH host-key… CWE-322
• GHSA-mxg3-432p-mr72 goshs: SSH host key verification disabled, allowing transparent MITM of every tunnelled… CWE-322
• CVE-2026-44467 The Claude Desktop app gives you Claude Code with a graphical interface built for running… CWE-322
• CVE-2026-1354 Zero Motorcycles firmware versions 44 and prior enable an attacker to forcibly pair a… CWE-322