AWS CLI EMR Commands Have SSH Verification Flaw – Update Required
AWS CLI versions 1.45.27 and earlier (v1) or 2.35.2 and earlier (v2) have a nasty security gap: the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) skip host key verification. This opens the door for man-in-the-middle attacks to intercept your SSH sessions and file transfers. You need to update immediately to patch CVE-2026-18654.