VDB
CVE-2026-18654
CVE-2026-18654
PUBLISHED
CVSS 6.9 MEDIUM
Reported by AMZN · Published August 3, 2026
Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To remediate this issue, users should upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later.
Risk Scores
CVSS 4.0
6.9
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AWS | aws-cli | 0, 0 |
| PyPI | awscli | 0 |
| chainguard | localstack | 0, 0, 0 |
| aws | aws-cli | 0, 0 |
| AWS | aws-cli | 0, 0 |
Timeline
- Aug 3, 2026 Coalition ESS Score
- Aug 3, 2026 CVE Published
- Aug 7, 2026 EPSS Score
- Aug 11, 2026 Security Advisory
- Aug 24, 2026 EPSS Score
- Aug 28, 2026 EPSS Score
- Sep 4, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 24, 2026 EPSS Score
References
- patchrelease-notes
- patchrelease-notes
- vendor-advisory
- release-notes
- https://nvd.nist.gov/vuln/detail/CVE-2026-18654 advisory
- https://github.com/advisories/GHSA-hqvf-45jj-mccq advisory
- https://aws.amazon.com/security/security-bulletins/2026-071-aws url