AWS Systems Manager Agent Vulnerability Allows Attackers to Bypass Port-Forwarding Restrictions

A critical vulnerability in the AWS Systems Manager Agent could let authenticated attackers bypass remote-host port-forwarding restrictions and access sensitive link-local services, including the Amazon EC2 Instance Metadata Service.

The flaw, tracked as CVE-2026-89049, affects Amazon SSM Agent versions earlier than 3.3.4851.0 and has been fixed in version 3.3.4851.0.

AWS Systems Manager Agent runs on Amazon EC2 instances, on-premises servers, and virtual machines to enable remote management capabilities such as Run Command and Session Manager.

Session Manager also supports port forwarding, allowing authorized users to create secure tunnels from a managed instance to a remote destination without exposing inbound network ports.

The issue exists in the remote-host port-forwarding feature used through the AWS-StartPortForwardingSessionToRemoteHost SSM document.

AWS Systems Manager Agent Vulnerability

According to the GitHub advisory, the agent’s denylist protection for link-local addresses can be bypassed because it does not properly validate equivalent address representations.

Link-local IP addresses are normally blocked because they can expose internal cloud services that should not be reachable through user-controlled tunnels. A primary target is the EC2 Instance Metadata Service, commonly available at 169.254.169.254.

This service can provide temporary credentials associated with the IAM role attached to an EC2 instance. An attacker must already have authenticated AWS access and permission to initiate a remote-host port-forwarding session.

However, successful exploitation could let that user route traffic to restricted link-local endpoints by using an alternative representation of a blocked destination address. The vulnerability is classified as server-side request forgery, or SSRF, and improper validation of unsafe equivalent input.

If the attacker retrieves instance profile credentials from the metadata service, they could use those credentials outside the compromised EC2 instance to make AWS API calls. The effective impact depends on the permissions assigned to the instance’s IAM role.

Overly permissive roles could enable access to S3 buckets, Secrets Manager secrets, databases, Lambda functions, or other cloud resources.

The advisory assigns the flaw a Critical severity rating with a CVSS v3.1 vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. This indicates that exploitation is network-reachable, requires low complexity and low privileges, needs no user interaction, and can affect confidentiality, integrity, and availability.

Organizations should immediately update affected systems to SSM Agent version 3.3.4851.0 or later. AWS also recommends reviewing forked or derivative builds of the agent to ensure they incorporate the validation fix.

Until patching is complete, administrators should restrict access to the AWS-StartPortForwardingSessionToRemoteHost document. IAM permissions for ssm: StartSession should be scoped so untrusted users, automation identities, and broadly assigned roles cannot establish remote-host port-forwarding sessions.

Security teams should additionally audit Session Manager activity, review IAM roles attached to EC2 instances, and apply least-privilege controls to instance profiles.

The Amazon SSM Agent configuration includes a default list of denied metadata and link-local endpoints. However, this vulnerability demonstrates why address validation must account for alternate representations rather than relying only on straightforward string matching.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.