A critical vulnerability in the AWS Systems Manager (SSM) Agent could allow authorized attackers to bypass Session Manager port-forwarding restrictions, access link-local services, and steal temporary IAM credentials assigned to Amazon EC2 instances.
Tracked as CVE-2026-89049, the issue affects AWS Systems Manager Agent versions earlier than 3.3.4851.0.
GitHub Security Advisory GHSA-w9jw-h72g-6hxc3 classifies the flaw as critical, with a CVSS v3.1 score reflecting network accessibility, low attack complexity, low privilege requirements, no user interaction, and high impact.
Critical AWS Flaw
The vulnerability exists in the AWS-StartPortForwardingSessionToRemoteHost capability of AWS Session Manager.
SSM Agent runs on managed AWS nodes and enables administrators and authorized users to establish remote management sessions without exposing SSH or RDP services directly to the internet.
Session Manager’s remote-host port-forwarding feature includes restrictions intended to prevent users from tunneling traffic to link-local addresses.
These addresses are particularly sensitive in AWS environments because the EC2 Instance Metadata Service (IMDS) is typically reachable through the link-local address 169.254.169.254.
According to AWS, the SSM Agent did not properly validate equivalent representations of blocked destination addresses.
An attacker could use an alternative IP address representation to evade the denylist, causing the agent to establish a connection to a link-local endpoint that should have been blocked.
The flaw is categorized as CWE-918, or Server-Side Request Forgery, and CWE-1289, improper validation of unsafe equivalence in input. The weakness effectively turns the managed instance into a proxy that can access internal destinations on behalf of a Session Manager user.
An authenticated principal with permission to start remote-host port-forwarding sessions could exploit the flaw to query the Instance Metadata Service. If the affected EC2 instance has an attached IAM role, the attacker may retrieve the role’s temporary AWS access credentials.
These credentials can be used outside the compromised instance to make AWS API calls permitted by the instance profile’s IAM policy. The practical impact therefore depends heavily on the permissions attached to the EC2 role.
For example, an instance profile with permissions to read Amazon S3 buckets, retrieve AWS Secrets Manager values, enumerate IAM resources, or access databases could give an attacker a path to wider cloud-account compromise.
Although exploitation requires authenticated access and Session Manager permissions, organizations should not treat the issue as low priority. SSM access is commonly delegated to developers, operations teams, automation accounts, and third-party support personnel.
Patch and Mitigation
AWS has addressed the vulnerability in SSM Agent version 3.3.4851.0. Organizations should upgrade affected managed nodes immediately and ensure internally maintained forks or derivative implementations incorporate the fix.
Until upgrades are complete, defenders should restrict access to the AWS-StartPortForwardingSessionToRemoteHost SSM document. IAM policies should limit ssm:StartSession permissions to trusted administrators and tightly scoped operational roles.
Security teams should also review CloudTrail logs for unexpected Session Manager activity, particularly remote-host port-forwarding sessions initiated by unusual users, roles, source IPs, or automation identities.
Detect 58% more threats with fresh intelligence from 16K+ organizations. Integrate TI Feeds in you SOC
 Agent could allow authorized attackers to bypass Session Manager port-forwarding restrictions, access link-local services, and steal temporary IAM credentials assigned to Amazon EC2 instances.){kind=link}