AWS CLI CVE-2026-18654

Upgrade to AWS CLI v1 1.45.28 or later, or AWS CLI v2 2.35.3 or later, as confirmed by the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-071-aws/ and documented in the v1 changelog at https://github.com/aws/aws-cli/blob/develop/CHANGELOG.rst and the v2 changelog at https://github.com/aws/aws-cli/blob/v2/CHANGELOG.rst. If immediate upgrade is not operationally feasible, organizations should avoid using the AWS CLI EMR SSH helper commands over untrusted, shared, or public network paths; instead, route EMR SSH traffic exclusively through AWS VPC private subnets or AWS PrivateLink endpoints to eliminate the network interposition attack surface - note this does not fix the underlying host authentication defect but removes attacker positioning opportunity. As an additional compensating control, administrators can manually verify EMR cluster host key fingerprints out-of-band against values recorded at cluster launch time, though this is operationally complex at scale. Upgrading to the patched release is the only complete remediation.