🟠 High | Source: AWS Security Bulletins
A vulnerability in the AWS CLI (CVE-2026-18654) causes EMR SSH helper commands to disable SSH host key verification, leaving sessions and file transfers open to man-in-the-middle interception. This affects all AWS CLI v1 versions up to and including 1.45.27, and all v2 versions up to and including 2.35.2. Anyone using the ‘aws emr ssh’, ‘socks’, ‘put’, or ‘get’ commands on an unpatched CLI could have their traffic intercepted by an attacker with network positioning between the client and the EMR cluster.
Security Architect’s Take: Prioritise upgrading AWS CLI to a patched version (v1 > 1.45.27 or v2 > 2.35.2) across all engineer workstations, CI/CD pipelines, and automation tooling that interact with EMR clusters. In the interim, enforce network-level controls (VPC endpoints, security groups, private subnets) to reduce the opportunity for man-in-the-middle positioning.
Original advisory: CVE-2026-18654 - Disabled SSH host key verification in AWS CLI EMR helper commands