(CVSS 9.9): AWS SSM Agent SSRF Flaw

Published September 10, 2026 CVE-2026-89049

Amazon SSM Agent can expose temporary AWS credentials from a managed machine. An authenticated user with port-forwarding permission could then act within that machine's AWS role.

Severity
CriticalCVSS 3.1 · 9.9
Fix
Fixed in 3.3.4851.0
Affected versions
before 3.3.4851.0
Weakness
CWE-918Server-Side Request Forgery (SSRF)
Exploit likelihood
0.36% in 30 daysEPSS, higher than 29% of known flaws
Affects
Amazon SSM Agent
Exploited
Not confirmedNo confirmation recorded
CISA SSVC
No known exploitationAutomatable: no · Technical impact: partial
EU ID
EUVD-2026-75674ENISA vulnerability database

How it works

  • An authenticated user with port-forwarding permission sends a destination using an alternate form of a blocked address.
  • SSM Agent does not recognize the alternate form as blocked.
  • It forwards the connection to a protected endpoint, which can return temporary IAM role credentials.

What to do

Check the SSM Agent version on each managed node and compare it with the AWS advisory. Versions below 3.3.4851.0 are in scope when remote-host port forwarding is supported.

Upgrade Amazon SSM Agent to version 3.3.4851.0 or later. Until then, restrict untrusted principals from starting remote-host port-forwarding sessions through the relevant IAM and Systems Manager document permissions.

Technical details

CVE-2026-89049 affects Amazon SSM Agent's Session Manager remote-host port forwarding. An authenticated principal with the required permission can bypass blocked link-local destinations using an equivalent address representation, potentially reaching the Instance Metadata Service and obtaining temporary instance-profile credentials.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required Low Attacker needs a basic user account
  • User interaction None No victim action needed
  • Scope Changed Impact crosses a security authority boundary
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source