CVE-2026-18654 AWS CVE debrief

Who should care

Defenders responsible for AWS CLI installations, particularly those using EMR SSH helper commands, should assess exposure and upgrade to a fixed version to prevent potential man-in-the-middle attacks.

Why it matters

CVE-2026-18654 allows man-in-the-middle attackers to potentially intercept SSH sessions and file transfers in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3. Defenders should upgrade to a fixed version and review inventory to prevent potential attacks.

• Man-in-the-middle attackers may intercept SSH sessions
• Man-in-the-middle attackers may intercept file transfers
• Upgrade to a fixed version to prevent potential attacks
• Verify inventory of AWS CLI installations to ensure compliance

Technical summary

The EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 do not perform entity authentication, allowing man-in-the-middle attackers to potentially intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint. This issue can be remediated by upgrading to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later. There is no information on exploitation or additional vendor guidance beyond upgrading to a fixed version. Defenders should verify inventory and upgrade to a fixed version.

Defensive priority

Upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later to remediate the issue.

Recommended defensive actions

• Upgrade to AWS CLI v1 1.45.28 or later
• Upgrade to AWS CLI v2 2.35.3 or later
• Review and update inventory of AWS CLI installations to ensure compliance
• Verify inventory of AWS CLI installations to ensure compliance
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD vulnerability detail page provide information on the vulnerability, including its description, CVSS score, and affected versions. The NVD entry is currently Analyzed. There is no information on exploitation or additional vendor guidance beyond upgrading to a fixed version. Defenders should verify inventory and upgrade to a fixed version.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.