CVE-2026-89049 in SSM Agent
Summary
by MITRE • 09/10/2026
A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote destination denylist and reach link-local endpoints, potentially obtaining the temporary IAM role credentials of a managed instance and acting with that role's permissions from outside the instance, via a crafted destination host value that uses an alternate representation of a denied link-local address.
To remediate this issue, users should upgrade to version 3.3.4851.0 or later.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/10/2026
The vulnerability identified in Amazon Web Services Systems Manager Agent prior to version 3.3.4851.0 represents a critical server-side request forgery flaw rooted in insufficient validation of network address representations. This specific weakness allows an authenticated remote user to manipulate the port forwarding functionality designed for connecting to remote hosts. The core technical failure lies in the agent's inability to normalize or strictly validate equivalent forms of IP addresses, particularly concerning link-local endpoints. By exploiting this logic gap, attackers can bypass security controls that are intended to restrict access to certain network ranges, specifically those designated as denied destinations within the SSM Agent configuration.
The operational impact of this vulnerability is severe due to its potential for credential theft and lateral movement within an AWS environment. An attacker who has authenticated access to a managed instance can craft a destination host value using alternate representations of link-local addresses that are typically blocked by denylists. Successfully exploiting this flaw enables the attacker to route requests through the compromised instance, effectively leveraging it as a proxy or pivot point. This capability allows the attacker to interact with internal services and endpoints that would otherwise be inaccessible from outside the instance network boundary.
A primary consequence of this exploitation is the potential exfiltration of temporary IAM role credentials associated with the managed instance. These credentials are often stored in memory or accessible via local metadata services, which become reachable through the forged requests. Once obtained, these credentials grant the attacker permissions equivalent to those assigned to the instance's IAM role. This elevates the threat from a simple network bypass to a significant compromise of identity and access management controls, allowing actions such as accessing other AWS resources, modifying configurations, or exfiltrating data based on the scope of the compromised role.
From a classification perspective, this vulnerability aligns with CWE-918, which describes Server-Side Request Forgery (SSRF). The specific mechanism involves bypassing access control lists through input validation weaknesses related to address normalization. In terms of offensive security frameworks, this behavior maps to ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Tool Transfer scenarios where the compromised host is used to facilitate further attacks against other systems within the trusted network perimeter. The exploitation relies on the attacker's ability to craft specific inputs that exploit parsing ambiguities in how the agent interprets destination addresses.
To mitigate this risk, organizations must ensure that all instances running Amazon Web Services Systems Manager Agent are updated to version 3.3.4851.0 or later. This update includes patches for the validation logic governing port forwarding destinations, ensuring that equivalent address representations are correctly identified and blocked if they fall within denied ranges. Additionally, security teams should review IAM role permissions assigned to managed instances to adhere to the principle of least privilege, thereby limiting the potential damage even if such a vulnerability were exploited in other contexts. Regular auditing of SSM Agent configurations and monitoring for unusual outbound connection patterns can also provide early detection indicators for similar exploitation attempts.