Critical SSRF Vulnerability in AWS Systems Manager Agent Exposes Cloud Credentials
A critical Server-Side Request Forgery (SSRF) vulnerability in AWS Systems Manager Agent allows low-privilege attackers to bypass port-forwarding restrictions and access sensitive EC2 instance metadata, potentially leading to credential theft and unauthorized resource access.
A critical vulnerability, identified as CVE-2026-89049, has been discovered in the AWS Systems Manager Agent (SSM Agent) that permits authenticated attackers to bypass port-forwarding restrictions. This flaw, present in versions prior to 3.3.4851.0, enables the exploitation of the agent's remote-host port-forwarding feature to access sensitive link-local services, most notably the EC2 Instance Metadata Service (IMDS).
The SSM Agent is a crucial component for managing AWS resources, including EC2 instances, on-premises servers, and virtual machines, facilitating operations like Run Command and Session Manager. The Session Manager's port-forwarding capability is designed to create secure tunnels to remote destinations without exposing inbound network ports. However, the vulnerability lies within the AWS-StartPortForwardingSessionToRemoteHost SSM document, where the agent's denylist protection for link-local addresses can be circumvented due to inadequate validation of equivalent address representations.
Attackers with existing authenticated AWS access and the necessary permissions to initiate a remote-host port-forwarding session can leverage this vulnerability. By using alternative representations of blocked destination addresses, they can route traffic to restricted link-local endpoints. The primary target is the EC2 Instance Metadata Service, typically accessible at 169.254.169.254, which provides temporary credentials tied to the instance's IAM role.
Successful exploitation could allow an attacker to retrieve these instance profile credentials and subsequently use them outside the compromised EC2 instance to make unauthorized AWS API calls. The extent of the damage hinges on the permissions granted to the instance's IAM role. If the role is overly permissive, attackers could gain access to sensitive cloud resources such as S3 buckets, Secrets Manager secrets, databases, and Lambda functions.
The vulnerability has been assigned a Critical severity rating with a CVSS v3.1 score of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This indicates that the exploit is network-accessible, requires low complexity and privileges, and has no user interaction requirement, while severely impacting confidentiality, integrity, and availability.
AWS has addressed this critical flaw by releasing version 3.3.4851.0 of the SSM Agent. Organizations are strongly urged to update all affected systems to this latest version immediately. Furthermore, AWS recommends that administrators review any forked or custom builds of the agent to ensure they have incorporated the necessary validation fix.
As an interim mitigation measure before patching is complete, AWS advises restricting access to the AWS-StartPortForwardingSessionToRemoteHost document. Specifically, IAM permissions for ssm:StartSession should be carefully scoped to prevent untrusted users, automation identities, and broadly assigned roles from establishing remote-host port-forwarding sessions. Security teams should also conduct thorough audits of Session Manager activity and review IAM roles attached to EC2 instances, enforcing least-privilege principles for instance profiles.
This incident underscores the importance of robust input validation, particularly when dealing with network-related features. Relying solely on straightforward string matching for denylists is insufficient; security measures must account for various equivalent representations of addresses to effectively prevent SSRF attacks and protect sensitive cloud environments.