Listen to this Post
How CVE-2026-18654 Works
The AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) passed `StrictHostKeyChecking=no` to the underlying SSH client, disabling host key verification. Host key verification is a critical security mechanism in SSH that ensures the client is connecting to the intended server and not an imposter. By disabling this check, the AWS CLI effectively instructs the SSH client to accept any host key presented without validation. This removes the cryptographic guarantee of the server’s identity, opening the door for man-in-the-middle (MitM) attacks.
A network-positioned actor could exploit this by intercepting the network traffic between the client machine and the EMR cluster endpoint. During the SSH handshake, the attacker’s machine could present its own host key. Because `StrictHostKeyChecking` is disabled, the client would accept this fraudulent key and proceed to establish an encrypted session with the attacker instead of the legitimate EMR instance. The attacker would then relay traffic to the real EMR cluster, maintaining the appearance of a normal connection while having full visibility of all commands executed, files transferred, and any credentials passed over the session. The vulnerability exists due to improper SSH host key verification in EMR helper commands. Successful exploitation requires the actor to have network access on the path between the client machine and the EMR cluster endpoint. Impacted versions are AWS CLI v1 <= 1.45.27 and AWS CLI v2 <= 2.35.2. This issue has been addressed in AWS CLI v1 version 1.45.28 and AWS CLI v2 version 2.35.3. The insecure SSH option was hardcoded and could not be overridden by the user, meaning there is no workaround besides upgrading. The vulnerability is classified as medium with a score of 6.8.
DailyCVE Form:
Platform: AWS CLI
Version: v1<=1.45.27/v2<=2.35.2
Vulnerability: MitM via SSH
Severity: Medium (CVSS 6.8)
date: 2026-08-03
Prediction: 2026-08-03
What Undercode Say:
Analytics show exploitation requires network adjacency to the EMR cluster. The attack vector is A (Network) with low complexity. No privileges are required, but user interaction is needed. The scope is changed, impacting confidentiality and integrity.
Check AWS CLI version aws --version Vulnerable command example (illustrative) aws emr ssh --cluster-id j-XXXXXXXXX --key-pair-file my-key.pem The underlying SSH command would have been: ssh -o StrictHostKeyChecking=no -o ServerAliveInterval=10 -i my-key.pem hadoop@<master-node-dns>
Exploit:
An attacker on the same network as the client can ARP spoof or otherwise redirect traffic to their machine. When the user executes an EMR SSH helper command, the attacker’s SSH server responds, and since host key checking is disabled, the client connects. The attacker can then log all traffic and potentially inject commands.
Attacker sets up a rogue SSH server to intercept the connection This is a simplified example of the traffic redirection sudo arpspoof -i eth0 -t <client-ip> <emr-cluster-ip> sudo arpspoof -i eth0 -t <emr-cluster-ip> <client-ip> Attacker then runs an SSH server that logs all sessions The client, using StrictHostKeyChecking=no, will connect to this rogue server
Protection:
Upgrade to AWS CLI v1 >= 1.45.28 or v2 >= 2.35.3. There is no workaround. Ensure network segmentation and monitoring to detect MitM attacks.
Impact:
A successful MitM attack grants the attacker full visibility into all commands executed, files transferred, and credentials passed over the SSH session. This could lead to unauthorized access to the EMR cluster, data exfiltration, and lateral movement within the AWS environment.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
