PT-2026-67492 · Aws · Aws Cli

CVE-2026-18654 · Published 2026-08-03 · Updated 2026-08-03

NVD

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint.

To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.

Fix

Weakness Enumeration

CWE-322

Related Identifiers

CVE-2026-18654

Affected Products

Aws Cli

References · 5

• https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst · Patch
• https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-18654 · Security Note
• https://aws.amazon.com/security/security-bulletins/2026-071-aws · Vendor Advisory
• https://github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccq · Note