Critical AWS SSM Agent Vulnerability Lets Attackers Bypass Port-Forwarding Restrictions

Key Takeaways

• A critical vulnerability (CVE-2026-89049) in the AWS Systems Manager Agent allows authenticated attackers to bypass port-forwarding restrictions.
• The flaw specifically impacts the remote-host port-forwarding feature, enabling access to sensitive link-local services like the Amazon EC2 Instance Metadata Service.
• Affected versions include Amazon SSM Agent versions earlier than 3.3.4851.0.
• A fix is available in version 3.3.4851.0 and later; immediate patching is strongly recommended.
• Exploitation requires existing AWS authentication and specific permissions, but can lead to compromise of cloud resources via stolen instance credentials.

Critical AWS SSM Agent Flaw Exposes Cloud Services

A significant security vulnerability has been identified within the AWS Systems Manager Agent, posing a critical risk to cloud environments. This flaw could permit authenticated attackers to circumvent established port-forwarding restrictions, thereby gaining unauthorized access to sensitive link-local services, including the critical Amazon EC2 Instance Metadata Service.

Designated as CVE-2026-89049, the vulnerability impacts Amazon SSM Agent versions preceding 3.3.4851.0. AWS has addressed this issue with the release of version 3.3.4851.0, urging all users to update their systems promptly.

Understanding the AWS Systems Manager Agent

The AWS Systems Manager Agent is a fundamental component deployed across Amazon EC2 instances, on-premises servers, and virtual machines. Its primary function is to facilitate remote management capabilities, such as the execution of commands via Run Command and the establishment of interactive sessions through Session Manager.

Among its features, Session Manager supports port forwarding, which allows authorized users to create secure, private tunnels from a managed instance to a specified remote destination. This mechanism is designed to enable secure connectivity without the need to expose inbound network ports, enhancing security by limiting direct network access.

The core of the newly discovered issue lies within the remote-host port-forwarding functionality, specifically when utilized through the AWS-StartPortForwardingSessionToRemoteHost SSM document.

The Nature of the Vulnerability

According to the GitHub advisory, the vulnerability stems from an inadequate validation mechanism within the agent’s denylist protection for link-local addresses. The system fails to properly recognize and block equivalent address representations, allowing attackers to bypass the intended restrictions.

Link-local IP addresses are typically blocked to prevent unauthorized access to internal cloud services that should remain isolated from user-controlled tunnels. A prime example and common target is the EC2 Instance Metadata Service, which is conventionally accessible at the IP address 169.254.169.254.

Exploitation of this flaw requires an attacker to possess authenticated AWS access and the necessary permissions to initiate a remote-host port-forwarding session. However, successful exploitation would enable such a user to route traffic to otherwise restricted link-local endpoints by employing an alternative, unblocked representation of a blacklisted destination address. This vulnerability is categorized as a server-side request forgery (SSRF) and an improper validation of unsafe equivalent input.

Should an attacker successfully retrieve instance profile credentials from the metadata service, these credentials could then be leveraged outside the compromised EC2 instance to execute AWS API calls. The potential impact of such an action is directly proportional to the permissions granted to the instance’s associated IAM role. Overly permissive roles could grant access to a wide array of cloud resources, including S3 buckets, Secrets Manager secrets, databases, and Lambda functions.

The advisory assigns this flaw a Critical severity rating, with a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This assessment indicates that the vulnerability is network-reachable, requires low complexity and low privileges for exploitation, does not necessitate user interaction, and can severely impact confidentiality, integrity, and availability of affected systems.

What You Should Do

• Update Immediately: Organizations must update all affected AWS Systems Manager Agents to version 3.3.4851.0 or later without delay.
• Review Forked Builds: If your organization uses forked or derivative builds of the SSM Agent, ensure that the validation fix has been incorporated into your custom versions.
• Restrict Access: Until patching is complete, restrict access to the AWS-StartPortForwardingSessionToRemoteHost document.
• Scope IAM Permissions: Tightly scope IAM permissions for ssm:StartSession to prevent untrusted users, automation identities, and broadly assigned roles from establishing remote-host port-forwarding sessions.
• Audit Session Manager Activity: Regularly audit Session Manager activity for any suspicious behavior.
• Review IAM Roles: Conduct thorough reviews of IAM roles attached to EC2 instances.
• Apply Least-Privilege: Implement and enforce least-privilege controls for all instance profiles to minimize potential impact in case of a breach.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.