AWS Systems Manager Agent Vulnerability Allows Attackers to Bypass Port-Forwarding Restrictions
Critical SSRF flaw in AWS SSM Agent (CVE-2026-89049) lets authenticated users bypass link-local denylists and reach EC2 Instance Metadata Service for IAM credentials.
CVE-2026-89049 (Critical, CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) affects Amazon SSM Agent versions earlier than 3.3.4851.0, with the fix shipping in 3.3.4851.0. The remote-host port-forwarding feature's denylist for link-local addresses can be bypassed because equivalent address representations are not validated, enabling SSRF to restricted endpoints such as the EC2 Instance Metadata Service at 169.254.169.254. An attacker with authenticated AWS access and ssm:StartSession permission could retrieve instance profile IAM credentials and pivot to S3, Secrets Manager, Lambda, or other cloud resources depending on role permissions.
- Fixed in SSM Agent 3.3.4851.0; all earlier versions vulnerable.
- Denylist bypass uses alternate representations of blocked link-local addresses.
- Enables SSRF to EC2 Instance Metadata Service and IAM credential theft.
- Requires authenticated AWS access and remote-host port-forwarding session permission.
- Restrict AWS-StartPortForwardingSessionToRemoteHost and scope ssm:StartSession until patched.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-89049 | SSRF in AWS Systems Manager Agent can expose instance IAM role credentials | 8.5 | — |
From the original article
2 min read at cybersecuritynews.com
A critical vulnerability in the AWS Systems Manager Agent could let authenticated attackers bypass remote-host port-forwarding restrictions and access sensitive link-local services, including the Amazon EC2 Instance Metadata Service. The flaw, tracked as CVE-2026-89049, affects Amazon SSM Agent versions earlier than 3. 3.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.