A serious security flaw in the AWS Systems Manager Agent has been identified, potentially allowing authenticated attackers to circumvent port-forwarding restrictions and access sensitive local services. The vulnerability specifically affects the Amazon EC2 Instance Metadata Service.
Details of the Security Flaw
This vulnerability, labeled as CVE-2026-89049, impacts Amazon SSM Agent versions prior to 3.3.4851.0. The issue has been resolved in subsequent updates, with version 3.3.4851.0 containing the necessary fixes. The AWS Systems Manager Agent facilitates remote management, including Run Command and Session Manager, on Amazon EC2 instances, on-premises servers, and virtual machines.
The Session Manager feature allows for secure port forwarding, enabling authorized users to establish protected connections from a managed instance to remote destinations without opening inbound network ports. The flaw lies within the remote-host port-forwarding feature, particularly when utilizing the AWS-StartPortForwardingSessionToRemoteHost SSM document.
Technical Analysis and Implications
According to a GitHub advisory, the agent’s denylist protection can be bypassed due to inadequate validation of link-local address representations. Typically, link-local IP addresses are blocked to prevent exposure of internal cloud services. However, an attacker could exploit this vulnerability to navigate around these restrictions using alternative address representations.
The EC2 Instance Metadata Service, often accessed at IP address 169.254.169.254, could be a primary target. This service provides temporary credentials tied to the IAM role of an EC2 instance. Successfully exploiting this flaw may allow attackers to obtain these credentials and use them to make AWS API calls beyond the compromised environment, depending on the permissions associated with the instance’s IAM role.
Recommendations for Mitigation
The vulnerability is classified as a server-side request forgery (SSRF) due to improper validation of unsafe input. It has been rated as Critical, with a CVSS v3.1 score indicating that the flaw is exploitable over a network, requires low complexity, and can severely affect confidentiality, integrity, and availability.
Organizations should promptly upgrade to SSM Agent version 3.3.4851.0 or later. Additionally, AWS advises reviewing any forked or derivative builds to confirm they incorporate the necessary validation enhancements. Until updates are applied, access to the AWS-StartPortForwardingSessionToRemoteHost document should be restricted, and IAM permissions for ssm:StartSession should be carefully managed to prevent unauthorized session initiation.
Security teams are encouraged to audit Session Manager activities, assess IAM roles linked to EC2 instances, and enforce least-privilege principles on instance profiles. The default configuration of the Amazon SSM Agent includes a denylist for metadata and link-local endpoints, highlighting the importance of robust address validation mechanisms.
