CVE-2026-18654 in AWS CLI
Summary
by MITRE • 08/03/2026
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint.
To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/03/2026
This vulnerability represents a critical security flaw in the Elastic MapReduce SSH helper commands within Amazon Web Services CLI implementations. The weakness stems from insufficient entity authentication during the key exchange process, creating an exploitable condition that allows malicious actors to position themselves between the client and EMR cluster endpoint. This man-in-the-middle attack vector specifically targets the SSH session establishment phase where proper certificate validation and host identification mechanisms are bypassed. The vulnerability affects both AWS CLI v1 versions prior to 1.45.28 and AWS CLI v2 versions before 2.35.3, indicating a widespread impact across multiple CLI generations. When exploited, this flaw enables attackers to intercept and potentially manipulate all SSH sessions and file transfers occurring between the client and EMR clusters, compromising data integrity and confidentiality.
The technical implementation of this vulnerability falls under CWE-310, which specifically addresses cryptographic weaknesses in key exchange processes. The flaw manifests as a failure to properly authenticate the remote entity during the secure communication establishment phase, creating a trust boundary violation that attackers can exploit. This weakness directly relates to the SSH protocol's host key verification mechanisms being circumvented or improperly implemented within the EMR helper commands. The attack scenario involves an attacker positioning themselves in the network path between the AWS CLI client and the EMR cluster endpoint, where they can intercept and potentially modify communications without detection.
The operational impact of this vulnerability extends beyond simple data interception to encompass potential complete system compromise. Attackers could gain unauthorized access to sensitive data stored within EMR clusters, manipulate processing workflows, or establish persistent backdoor access through compromised SSH sessions. The implications are particularly severe for organizations handling regulated data or mission-critical analytics workloads where the integrity of distributed computing operations is paramount. Additionally, the vulnerability affects not only the initial SSH connection establishment but also all subsequent file transfers and session communications, amplifying the attack surface and potential damage scope.
Organizations should immediately implement the recommended remediation measures by upgrading to AWS CLI v1 1.45.28 or later versions, or AWS CLI v2 2.35.3 or later releases. This upgrade addresses the core cryptographic implementation issues by restoring proper host authentication mechanisms during SSH key exchange processes. Security teams should also conduct comprehensive network monitoring to detect any potential exploitation attempts and implement additional security controls such as SSH certificate authorities, network segmentation, and enhanced logging of EMR cluster access patterns. The fix aligns with ATT&CK technique T1566 which covers credential harvesting through man-in-the-middle attacks, making it crucial for organizations to address this vulnerability promptly to maintain their overall security posture against sophisticated adversarial tactics.