CVE-2026-18654: AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands

August 6, 2026

The AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) passed StrictHostKeyChecking=no to the underlying SSH client, disabling host key verification.

References

aws.amazon.com/security/security-bulletins/2026-071-aws
github.com/advisories/GHSA-hqvf-45jj-mccq
github.com/aws/aws-cli/blob/develop/CHANGELOG.rst
github.com/aws/aws-cli/blob/v2/CHANGELOG.rst
github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccq
nvd.nist.gov/vuln/detail/CVE-2026-18654

Code Behaviors & Features

Detect and mitigate CVE-2026-18654 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →