Executive brief
AWS CLI includes helper commands for managing Elastic MapReduce (EMR) clusters that disable SSH host key verification, a critical security check that validates a server's identity. An attacker on the network can intercept and manipulate SSH connections to EMR cluster nodes, potentially stealing credentials, injecting malicious commands, or redirecting traffic to attacker-controlled systems. Organizations using AWS CLI to provision or manage EMR clusters are at risk of unauthorized cluster access and data exposure.
Technical details
The AWS CLI EMR helper commands disable SSH host key verification by not properly validating server public keys during SSH connection establishment. This allows man-in-the-middle (MITM) attacks on the SSH channel used to configure and manage EMR cluster nodes. The vulnerability affects network-based attackers in a position to intercept or redirect SSH traffic (adjacent network, compromised gateway, or rogue access point). An attacker can intercept credentials passed during cluster provisioning, execute arbitrary commands on cluster nodes, or perform privilege escalation. No authentication bypass is required; the flaw exists in the SSH client configuration itself. AWS has released patches; users should update to the latest AWS CLI version.
Affected products
- Amazon AWS CLI versions with EMR helper commands
Timeline
- 2026-09-09: disclosed