{"items":[{"id":"NVI-00015069","kind":"vulnerability","title":"AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-hqvf-45jj-mccq","CVE-2026-18654"],"plain_summary":"GitHub lists this reviewed advisory for awscli. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-15f2a11ffc5d692b80fe3ebab1551053"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-08-06T20:15:31.000Z","value":"6.8 medium","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-15f2a11ffc5d692b80fe3ebab1551053"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-15f2a11ffc5d692b80fe3ebab1551053","url":"https://github.com/advisories/GHSA-hqvf-45jj-mccq","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-hqvf-45jj-mccq","publisher":"GitHub Advisory Database","observed_at":"2026-11-03T02:28:46.523Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-15f2a11ffc5d692b80fe3ebab1551053"],"technology":"awscli","known_exclusions":[],"conditions_summary":"### Summary\nThe AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. An issue exists where the EMR SSH helper commands (`aws emr ssh`, `aws emr socks`, `aws emr put`, `aws emr get`) passed `StrictHostKeyChecking=no` to the underlying SSH client, disabling host key verification.\n\n### Impact\nA network-positioned actor could perform a man-in-the-middle action to intercept SSH sessions and file transfers between the client and EMR cluster instances. Successful exploitation requires the actor to have network access on the path between the client machine and the EMR cluster endpoint. This could result in full visibility of commands executed, files transferred, and credentials passed over the SSH session.\n\nImpacted versions: AWS CLI v1 <= 1.45.27, AWS CLI v2 <= 2.35.2\n\n### Patches\nThis issue has been addressed in AWS CLI v1 version 1.45.28 and AWS CLI v2 version 2.35.3. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\n### Workarounds\nThere is no workaround. The insecure SSH option was hardcoded and could not be overridden by the user.\n\n### References\nIf you have","public_affected_ranges":["<= 1.45.27"]}],"null_published_at":"2026-11-03T10:03:26.542Z","source_updated_at":"2026-08-06T20:15:31.000Z","source_disclosed_at":"2026-08-06T20:15:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-03T02:28:46.523Z"}],"next_cursor":null,"snapshot_revision":"42594"}