PyPI/awscli CVE-2026-18654: medium 6.8, EPSS 0.46%
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
Action: Upgrade awscli to 1.45.28 or later.
pip install awscli==1.45.28Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.45.28 | - |
Fixed versions
| 1.45.28 |
Sources
- osv: PYSEC-2026-3627
- https://github.com/aws/aws-cli/security/advisories/GHSA-hqvf-45jj-mccq
- https://nvd.nist.gov/vuln/detail/CVE-2026-18654
- https://aws.amazon.com/security/security-bulletins/2026-071-aws
- https://github.com/aws/aws-cli
- https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst
- https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst
- https://pypi.org/project/awscli
- https://github.com/advisories/GHSA-hqvf-45jj-mccq
CVE-2026-18654 · published · modified · JSON