CVE-2026-18654: AWS CLI SSH Host Key Verification Disabled Vulnerability
Summary
CVE-2026-18654: AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands. Affects awscli versions < 1.45.28. Fixed in 1.45.28. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS Command Line Interface (AWS CLI) is a unified tool that allows users to manage AWS services through command line commands. It provides a consistent interface for various AWS services, enabling automation and scripting of tasks. However, a vulnerability has been identified in the EMR SSH helper commands, which compromises the security of SSH connections.
Vulnerability Detail
The vulnerability arises from the AWS CLI EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) passing the option StrictHostKeyChecking=no to the SSH client. This disables host key verification, making it possible for a network-positioned attacker to perform a man-in-the-middle attack. Such an attack could allow the attacker to intercept SSH sessions and file transfers, leading to unauthorized access to commands executed, files transferred, and credentials shared over the SSH connection. The affected versions include AWS CLI v1 up to 1.45.27 and AWS CLI v2 up to 2.35.2.
How To Fix
Latest published version: 1.46.2 as of 23 Oct 2026
pip install --upgrade "awscli==1.46.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.45.28
This is the first release that contains the fix.
pip install --upgrade "awscli==1.45.28"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no workarounds available for this vulnerability, as the insecure SSH option was hardcoded and cannot be overridden by the user.
Conclusion
In summary, the AWS CLI vulnerability CVE-2026-18654 poses a significant risk by disabling SSH host key verification in EMR helper commands. Users are strongly advised to upgrade to the latest patched versions to mitigate this risk and protect sensitive data.
See every vulnerability recorded for awscli →
FAQ
The vulnerability allows a network-positioned attacker to intercept SSH sessions and file transfers, potentially exposing sensitive information.
AWS CLI v1 versions up to 1.45.27 and AWS CLI v2 versions up to 2.35.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Unfortunately, there are no workarounds available for this vulnerability, so upgrading to the patched version is essential.
The CVSS score of this vulnerability is 6.8, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for awscli.
