AWS Systems Manager Agent Vulnerability Allows Attackers to Bypass Port-Forwarding Restrictions
Critical SSRF flaw in AWS SSM Agent (CVE-2026-89049) lets authenticated users bypass link-local denylists and reach EC2 Instance Metadata Service for IAM credentials.
CVE-2026-89049 (Critical, CVSS v3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) affects Amazon SSM Agent versions earlier than 3.3.4851.0, with the fix shipping in 3.3.4851.0. The remote-host port-forwarding feature's denylist for link-local addresses can be bypassed because equivalent address representations are not validated, enabling SSRF to restricted endpoints such as the EC2 Instance Metadata Service at 169.254.169.254. An attacker with authenticated AWS access and ssm:StartSession permission could retrieve instance profile IAM credentials and pivot to S3, Secrets Manager, Lambda, or other cloud resources depending on role permissions.
- Fixed in SSM Agent 3.3.4851.0; all earlier versions vulnerable.
- Denylist bypass uses alternate representations of blocked link-local addresses.
- Enables SSRF to EC2 Instance Metadata Service and IAM credential theft.
- Requires authenticated AWS access and remote-host port-forwarding session permission.
- Restrict AWS-StartPortForwardingSessionToRemoteHost and scope ssm:StartSession until patched.
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-89049 | SSRF in AWS Systems Manager Agent can expose instance IAM role credentials AWS Systems Manager Agent (SSM Agent) versions before 3.3.4851.0 on all platforms contain a server-side request forgery (CWE-918) in the port-forwarding-to-remote-hosts functionality, caused by improper validation of equivalent address representations (CWE-1289) when checking destination hosts against the remote destination denylist. An authenticated remote user with privileges to start an SSM Session Manager port-forwarding session can supply a crafted destination host value that expresses a denied link-local address in an alternate representation, bypassing the denylist and causing the agent to reach link-local endpoints such as the instance metadata service. From there, the attacker can potentially obtain the managed instance's temporary IAM role credentials and then act with that role's permissions from outside the instance, producing high confidentiality impact on the node and on downstream systems reachable with the role. The flaw affects any organization running affected SSM Agent versions on managed nodes, including EC2 instances, hybrid-activated on-premises servers, VMs and edge devices. No public proof-of-concept is known and the issue is not in the CISA KEV catalog, so no active exploitation is known at this time. Do: Upgrade SSM Agent to version 3.3.4851.0 or later on every managed node across all platforms (EC2 instances, hybrid-activated on-premises servers, VMs and edge devices), and inventory current agent versions via Systems Manager to find stragglers. As interim risk reduction, restrict IAM permissions for initiating Session Manager port-forwarding sessions and scope managed-instance IAM roles tightly so stolen role credentials have limited downstream access. | 8.5 | — |
| masslikely millions of SSM-managed instances/nodes (SSM Agent ships by default in Amazon Linux and many AWS machine images) |
Full article514 words · extracted from cybersecuritynews.com · click to collapse
A critical vulnerability in the AWS Systems Manager Agent could let authenticated attackers bypass remote-host port-forwarding restrictions and access sensitive link-local services, including the Amazon EC2 Instance Metadata Service.
The flaw, tracked as CVE-2026-89049, affects Amazon SSM Agent versions earlier than 3.3.4851.0 and has been fixed in version 3.3.4851.0.
AWS Systems Manager Agent runs on Amazon EC2 instances, on-premises servers, and virtual machines to enable remote management capabilities such as Run Command and Session Manager.
Session Manager also supports port forwarding, allowing authorized users to create secure tunnels from a managed instance to a remote destination without exposing inbound network ports.
The issue exists in the remote-host port-forwarding feature used through the AWS-StartPortForwardingSessionToRemoteHost SSM document.
AWS Systems Manager Agent Vulnerability
According to the GitHub advisory, the agent’s denylist protection for link-local addresses can be bypassed because it does not properly validate equivalent address representations.
Link-local IP addresses are normally blocked because they can expose internal cloud services that should not be reachable through user-controlled tunnels. A primary target is the EC2 Instance Metadata Service, commonly available at 169.254.169.254.
This service can provide temporary credentials associated with the IAM role attached to an EC2 instance. An attacker must already have authenticated AWS access and permission to initiate a remote-host port-forwarding session.
However, successful exploitation could let that user route traffic to restricted link-local endpoints by using an alternative representation of a blocked destination address. The vulnerability is classified as server-side request forgery, or SSRF, and improper validation of unsafe equivalent input.
If the attacker retrieves instance profile credentials from the metadata service, they could use those credentials outside the compromised EC2 instance to make AWS API calls. The effective impact depends on the permissions assigned to the instance’s IAM role.
Overly permissive roles could enable access to S3 buckets, Secrets Manager secrets, databases, Lambda functions, or other cloud resources.
The advisory assigns the flaw a Critical severity rating with a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This indicates that exploitation is network-reachable, requires low complexity and low privileges, needs no user interaction, and can affect confidentiality, integrity, and availability.
Organizations should immediately update affected systems to SSM Agent version 3.3.4851.0 or later. AWS also recommends reviewing forked or derivative builds of the agent to ensure they incorporate the validation fix.
Until patching is complete, administrators should restrict access to the AWS-StartPortForwardingSessionToRemoteHost document. IAM permissions for ssm: StartSession should be scoped so untrusted users, automation identities, and broadly assigned roles cannot establish remote-host port-forwarding sessions.
Security teams should additionally audit Session Manager activity, review IAM roles attached to EC2 instances, and apply least-privilege controls to instance profiles.
The Amazon SSM Agent configuration includes a default list of denied metadata and link-local endpoints. However, this vulnerability demonstrates why address validation must account for alternate representations rather than relying only on straightforward string matching.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
Abinayahttps://cybersecuritynews.com/
Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cybersecuritynews.com/aws-systems-manager-agent-vulnerability/