Amazon Linux 2 : awscli (ALAS-2026-3966)

The version of awscli installed on the remote host is prior to 1.18.147-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2026-3966 advisory. Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has...

Amazon Linux 2023 : awscli-2 (ALAS2023-2026-3133)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3133 advisory. Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file permissions the default on most...

Medium: awscli-2

Issue Overview: Overly permissive file permissions in AWS CLI before 1.44.78 v1 and 2.34.29 v2 on Unix-like systems where the umask has not been configured to restrict file permissions the default on most systems may allow other local users on the same host to read credentials written by certain...

CVE-2026-18654

This CVE (CVE-2026-18654) affects the EMR SSH helper commands in the Amazon AWS CLI. The issue is “Key exchange without entity authentication,” enabling potential MITM attackers to intercept SSH sessions and file transfers when connecting to an EMR cluster endpoint. Affected products are AWS CLI ...

CVE-2026-18654

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...

CVE-2026-18654: Key Exchange without Entity Authentication

Key exchange without entity authentication in the EMR SSH helper commands in Amazon AWS CLI before 1.45.28 and AWS CLI v2 before 2.35.3 might allow man-in-the-middle attackers to intercept SSHsessions and file transfers via network positioning between the client and the EMR cluster endpoint. To...