Amazon Web Services has patched a serious vulnerability in the AWS Systems Manager Agent (SSM Agent) that lets authenticated users bypass port-forwarding restrictions and reach link-local services, including the sensitive EC2 Instance Metadata Service.
What’s the issue?
The flaw, identified as CVE-2026-89049, affects versions of the AWS SSM Agent earlier than 3.3.4851.0. Attackers with authenticated access and permission to use the AWS-StartPortForwardingSessionToRemoteHost document can exploit this vulnerability. The core problem lies in how the agent validates destination addresses: its deny-list protection does not properly handle alternate or equivalent representations of link-local IP addresses, enabling bypass of safeguards designed to block traffic to those internal network interfaces.
Potential consequences
Link-local endpoints are blocked in most cases because they can expose internal cloud services that should not be reachable by user-initiated tunnels. One critical target in this instance is the EC2 Instance Metadata Service (at IP 169.254.169.254), which stores IAM role credentials attached to EC2 instances. If an attacker successfully tricks the system into forwarding traffic to metadata or other restricted link-local endpoints using a manipulated or equivalent representation of the address, they might access those credentials. Once obtained, these IAM credentials could then be used beyond the compromised instance to access other AWS resources.
The level of damage depends on how permissive the IAM role is. Overly broad privileges might allow data exfiltration from S3 buckets, retrieval of secrets from Secrets Manager, access to databases, or interaction with Lambda, among other services. The vulnerability has been rated Critical with a CVSS v3.1 score indicating network reachability, low complexity, minimal privileges required, no user interaction needed, and potential impact on confidentiality, integrity, and availability.
What to do
AWS has released SSM Agent version 3.3.4851.0 or later to fix this vulnerability. Users should immediately upgrade any affected agents. Also, those using custom- or derivative builds must ensure the validation fix is present in their versions.
As temporary mitigation until updates are in place, it’s advised to restrict access to the AWS-StartPortForwardingSessionToRemoteHost document. IAM permissions for the ssm:StartSession action should be tightly scoped: untrusted users, widespread roles, and automation systems should not have the ability to launch port-forwarding sessions. Additionally, teams should audit Session Manager logs, inspect IAM roles on EC2 instances, and practice least-privilege design for instance profiles.
Why this matters
SSM Agent runs on EC2 instances, virtual machines, and even on-premise servers. It is a core tool for remote management, offering capabilities like Run Command and Session Manager. Port forwarding through Session Manager is generally considered safer than opening inbound ports—but this vulnerability undermines that assumption by exposing services typically shielded behind link-local IPs.
This flaw is a reminder that even well-trusted tools can harbor subtle bypasses in input validation, especially around equivalency or alternate address representations. Administrators should stay on guard.
Looking ahead, it’s vital for cloud teams to treat edge features like remote port-forwarding with suspicion unless their security implications are fully understood. Proper address validation should be considered just as important as role-based access controls. Organizations should monitor for signs that link-local traffic is being accessed via unusual channels, conduct regular security reviews, and make prompt updates when patches are available.
