{"id":"CVE-2026-89049","kind":"vulnerability","aliases":["CVE-2026-89049"],"related":[],"title":"AWS SSM Agent: port forwarding lets users reach instance IAM credentials","description":"CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent\n\n### CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent\n\nBulletin ID: 2026-107-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 11:30 AM PDT\n\nDescription:\n\nAWS Systems Manager Agent (SSM Agent) is software that runs on managed nodes (EC2 instances, on-premises servers, and other supported machines) and processes requests from the AWS Systems Manager service, enabling capabilities including Session Manager port forwarding to remote hosts. We identified CVE-2026-89049, a server-side request forgery issue in the remote-host port forwarding functionality. Due to improper validation of equivalent address representations, an authenticated user with port-forwarding permission could bypass the remote destination denylist and reach link-local endpoints, potentially obtaining the managed instance's temporary IAM role credentials and acting with that role's permissions from outside the instance.\n\nImpacted versions: < 3.3.4851.0 (all versions supporting remote-host port forwarding)\n\nResolution:\n\nThis issue has been addressed in SSM Agent version 3.3.4851.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUntil the agent is upgraded, restrict use of the AWS-StartPortForwardingSessionToRemoteHost document by scoping ssm:StartSession IAM permissions and SSM document permissions so that untrusted principals cannot start remote-host port-forwarding sessions.\n\nReferences:\n\n- CVE-2026-89049\n- GHSA-w9jw-h72g-6hxc\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"AWS Systems Manager Agent on managed nodes fails to match equivalent address forms against its remote-host denylist in Session Manager port forwarding. An authenticated user with port-forwarding permission can reach link-local endpoints and obtain the instance's temporary IAM role credentials.","severity":"critical","cvss":9.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["aws","ec2","iam","infrastructure","lab-disclosure","on-premises","systems-manager"],"not_affected_if":["agent-3.3.4851.0-or-later","no-remote-host-port-forwarding"],"how_to_check":"- Check the installed SSM Agent version on managed nodes, for example `amazon-ssm-agent -version` on Linux or the installed version in Windows Add/Remove Programs\n- Confirm whether the AWS-StartPortForwardingSessionToRemoteHost document is used in your account, and which principals hold ssm:StartSession for it","fix":"- Upgrade SSM Agent to `3.3.4851.0` or later on all managed nodes\n- Until upgraded, restrict ssm:StartSession and SSM document permissions so untrusted principals cannot start remote-host port-forwarding sessions\n- Patch any forked or derivative SSM Agent code with the new fixes","status":"open","published_at":"2026-09-10T19:17:42+00:00","first_seen_at":"2026-10-24T19:28:15+00:00","triaged_at":"2026-10-25T05:27:55+00:00","updated_at":"2026-10-25T05:27:55+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-25T05:27:55Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade SSM Agent to `3.3.4851.0` or later on all managed nodes\n- Until upgraded, restrict ssm:StartSession and SSM document permissions so untrusted principals cannot start remote-host port-forwarding sessions\n- Patch any forked or derivative SSM Agent code with the new fixes","reach":"network","title":"AWS SSM Agent: port forwarding lets users reach instance IAM credentials","impact":"high","summary":"AWS Systems Manager Agent on managed nodes fails to match equivalent address forms against its remote-host denylist in Session Manager port forwarding. An authenticated user with port-forwarding permission can reach link-local endpoints and obtain the instance's temporary IAM role credentials.","category":"infrastructure","nicknames":[],"who_cares":["aws","ec2","systems-manager","on-premises","iam"],"confidence":0.8,"needs_auth":"yes","worst_case":"Attacker obtains instance IAM role credentials and acts with that role's permissions","analyst_note":"","how_to_check":"- Check the installed SSM Agent version on managed nodes, for example `amazon-ssm-agent -version` on Linux or the installed version in Windows Add/Remove Programs\n- Confirm whether the AWS-StartPortForwardingSessionToRemoteHost document is used in your account, and which principals hold ssm:StartSession for it","needs_analyst":false,"not_affected_if":["agent-3.3.4851.0-or-later","no-remote-host-port-forwarding"],"who_is_affected":"Any managed node running SSM Agent below 3.3.4851.0 that supports remote-host port forwarding, including EC2 instances and on-premises servers. Exposure depends on who holds port-forwarding permission, so accounts where only trusted principals can start Session Manager sessions face lower risk. Teams that already run the latest agent can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000744,"input_tokens":3965,"output_tokens":695,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-107':121C '-2026':13A,16A,79C,99C,183C,331C '-89049':14A,17A,80C,100C,184C,332C '09/10/2026':132C '11':133C '2026':120C '3.3.4851.0':251C,270C '30':134C '6hxc':337C 'act':239C 'address':42B,206C,265C 'agent':3A,34B,97C,117C,141C,143C,268C,295C 'attent':129C 'authent':56B,209C 'aw':1A,18B,31B,94C,114C,122C,124C,138C,166C,303C 'aws-security@amazon.com':340C 'aws-startportforwardingsessiontoremotehost':302C 'bulletin':118C 'bypass':217C 'cannot':320C 'capabl':171C 'code':284C 'concern':346C 'content':125C 'could':216C 'credenti':11A,77B,237C 'cve':12A,15A,78C,98C,182C,330C 'date':131C 'denylist':49B,221C 'deriv':283C 'descript':137C 'destin':220C 'disclosur':24B 'document':305C,314C 'due':200C 'ec2':19B,151C 'email':339C 'enabl':170C 'endpoint':68B,227C 'ensur':279C 'equival':41B,205C 'fail':38B 'fix':291C 'forgeri':85C,105C,190C 'fork':281C 'form':43B 'forward':5A,54B,61B,91C,111C,176C,198C,214C,259C,327C 'function':92C,112C,199C 'ghsa':334C 'ghsa-w9jw-h72g-6hxc':333C 'h72g':336C 'host':48B,179C,196C,257C,324C 'iam':10A,20B,75B,235C,310C 'id':119C 'identifi':181C 'impact':249C 'import':127C 'improp':202C 'includ':172C 'incorpor':288C 'infrastructur':21B 'instanc':9A,72B,152C,232C,248C 'issu':191C,262C 'lab':23B 'lab-disclosur':22B 'latest':276C 'let':6A 'link':66B,225C 'link-loc':65B,224C 'local':67B,226C 'machin':160C 'manag':30B,33B,36B,52B,89C,96C,109C,116C,140C,149C,168C,174C,231C 'match':40B 'new':290C 'node':37B,150C 'obtain':70B,229C 'on-premis':25B,153C 'outsid':246C 'patch':286C 'pdt':136C 'permiss':62B,215C,244C,311C,315C 'pleas':338C 'port':4A,53B,60B,90C,110C,175C,197C,213C,258C,326C 'port-forward':59B,212C,325C 'potenti':228C 'premis':27B,155C 'princip':319C 'process':162C 'public':130C 'question':344C 'reach':8A,64B,223C 'recommend':272C 'refer':329C 'remot':47B,178C,195C,219C,256C,323C 'remote-host':46B,194C,255C,322C 'represent':207C 'request':84C,104C,163C,189C 'requir':128C 'resolut':260C 'restrict':298C 'role':76B,236C,242C 'run':147C 'scope':123C,307C 'secur':343C 'server':82C,102C,156C,187C 'server-sid':81C,101C,186C 'servic':169C 'session':51B,88C,108C,173C,328C 'side':83C,103C,188C 'softwar':145C 'ssm':2A,142C,267C,308C,313C 'start':321C 'startportforwardingsessiontoremotehost':304C 'startsess':309C 'support':159C,254C 'system':29B,32B,95C,115C,139C,167C 'systems-manag':28B 'temporari':74B,234C 'type':126C 'untrust':318C 'upgrad':273C,297C 'use':299C 'user':7A,57B,210C 'valid':203C 'version':250C,253C,269C,277C 'w9jw':335C 'workaround':292C","nicknames":[],"mitigations":[{"kind":"workaround","scope":"AWS Systems Manager Agent (SSM Agent) Session Manager remote-host port forwarding (AWS-StartPortForwardingSessionToRemoteHost)","since":null,"covers":"Untrusted principals starting remote-host port-forwarding sessions via the AWS-StartPortForwardingSessionToRemoteHost document","limits":"none stated","source":"https://aws.amazon.com/security/security-bulletins/rss/2026-107-aws/","vendor":"Team","seen_at":"2026-10-24T21:50:12Z","confidence":0.8,"source_title":"CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent","customer_action":"Restrict ssm:StartSession IAM permissions and SSM document permissions so untrusted principals cannot start remote-host port-forwarding sessions, until SSM Agent is upgraded to 3.3.4851.0"}],"who_affected":"Any managed node running SSM Agent below 3.3.4851.0 that supports remote-host port forwarding, including EC2 instances and on-premises servers. Exposure depends on who holds port-forwarding permission, so accounts where only trusted principals can start Session Manager sessions face lower risk. Teams that already run the latest agent can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-10T19:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-107-aws/#CVE-2026-89049","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-107-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T19:28:15+00:00","fetched_at":"2026-10-24T21:51:20+00:00","note":"AWS: CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent"},{"source":"nvd","external_id":"CVE-2026-89049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89049","severity":null,"published_at":"2026-09-10T19:17:42+00:00","modified_at":"2026-09-10T19:44:21+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null}],"documents":[{"id":2945,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-107-aws/","title":"AWS: CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent","kind":"advisory","source":"lab","text":"CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent\n\n### CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent\n\nBulletin ID: 2026-107-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 11:30 AM PDT\n\nDescription:\n\nAWS Systems Manager Agent (SSM Agent) is software that runs on managed nodes (EC2 instances, on-premises servers, and other supported machines) and processes requests from the AWS Systems Manager service, enabling capabilities including Session Manager port forwarding to remote hosts. We identified CVE-2026-89049, a server-side request forgery issue in the remote-host port forwarding functionality. Due to improper validation of equivalent address representations, an authenticated user with port-forwarding permission could bypass the remote destination denylist and reach link-local endpoints, potentially obtaining the managed instance's temporary IAM role credentials and acting with that role's permissions from outside the instance.\n\nImpacted versions: < 3.3.4851.0 (all versions supporting remote-host port forwarding)\n\nResolution:\n\nThis issue has been addressed in SSM Agent version 3.3.4851.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUntil the agent is upgraded, restrict use of the AWS-StartPortForwardingSessionToRemoteHost document by scoping ssm:StartSession IAM permissions and SSM document permissions so that untrusted principals cannot start remote-host port-forwarding sessions.\n\nReferences:\n\n- CVE-2026-89049\n- GHSA-w9jw-h72g-6hxc\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}