AMAZON has disclosed a critical server-side request forgery (SSRF) flaw in the AWS Systems Manager (SSM) Agent, tracked as CVE-2026-89049, with a CVSS score of 9.9. The issue affects all SSM Agent versions before 3.3.4851.0 and centers on the Session Manager port forwarding feature.
An authenticated user who can start remote-host port-forwarding sessions could bypass the destination denylist and reach link-local endpoints, notably the Instance Metadata Service, enabling the extraction of active IAM role credentials. Those credentials could then be misused to carry out AWS API calls from outside the targeted instance.
At the time of reporting, there was no confirmed exploitation or public PoC publicly published, but the potential risk is considerable given the common deployment of SSM across large EC2 fleets.
Amazon’s patch is contained in agent version 3.3.4851.0. Organisations should upgrade all managed nodes to this release immediately to mitigate the SSRF risk and protect instance metadata and cloud credentials. If rapid patching is not feasible, a recommended interim control is to restrict the ssm:StartSession IAM permission to prevent untrusted principals from initiating remote-host port forwarding.
The advisory emphasises that the vulnerability could enable an attacker to obtain temporary IAM credentials from the Instance Metadata Service, underscoring the importance of applying the update promptly to safeguard cloud workloads.