CVE-2026-18654

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-18654
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.

6.8 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://aws.amazon.com/security/security-bulletins/2026-071-aws/ Vendor Advisory
https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst Release Notes
https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst Release Notes
https://github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccq Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:amazon:aws_command_line_interface:*:*:*:*:*:*:*:*
cpe:2.3:a:amazon:aws_command_line_interface:*:*:*:*:*:*:*:*
History

23 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) El intercambio de claves sin autenticación de entidad en los comandos auxiliares SSH de EMR en Amazon AWS CLI anterior a 1.45.28 y AWS CLI v2 anterior a 2.35.3 podría permitir a atacantes man-in-the-middle interceptar sesiones SSH y transferencias de archivos mediante posicionamiento de red entre el cliente y el punto final del clúster EMR. Para remediar este problema, los usuarios deben actualizar a AWS CLI v1 1.45.28 o posterior, o AWS CLI v2 2.35.3 o posterior.

23 Oct 2026, 17:38

Type Values Removed Values Added
CPE cpe:2.3:a:amazon:aws_command_line_interface:*:*:*:*:*:*:*:*
References () https://aws.amazon.com/security/security-bulletins/2026-071-aws/ - () https://aws.amazon.com/security/security-bulletins/2026-071-aws/ - Vendor Advisory
References () https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst - () https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst - Release Notes
References () https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst - () https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst - Release Notes
References () https://github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccq - () https://github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccq - Vendor Advisory
First Time Amazon
Amazon aws Command Line Interface
Information

Published : 2026-08-03 20:17

Updated : 2026-10-23 21:10

NVD link : CVE-2026-18654

Mitre link : CVE-2026-18654

CVE.ORG link : CVE-2026-18654

JSON object : View

Products Affected

amazon

  • aws_command_line_interface
CWE
CWE-322

Key Exchange without Entity Authentication