---
id: "GHSA-w9jw-h72g-6hxc"
kind: "vulnerability"
aliases: ["GHSA-w9jw-h72g-6hxc"]
title: "CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["aws", "ec2", "iam", "infrastructure", "lab-disclosure", "on-premises", "ssm-agent"]
not_affected_if: ["agent-at-or-above-3.3.4851.0", "no-remote-host-port-forwarding-permission"]
published_at: null
first_seen_at: "2026-10-24T19:28:15+00:00"
updated_at: "2026-10-25T04:51:27+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-107-aws/", "first_seen_at": "2026-10-24T19:28:15+00:00"}]
---

# CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

The AWS Systems Manager Agent on managed nodes fails to validate equivalent address forms in Session Manager remote-host port forwarding, so the denylist can be bypassed. An authenticated user with port-forwarding permission can reach link-local endpoints and obtain the instance's temporary IAM role credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed SSM Agent version on managed nodes, for example `amazon-ssm-agent -version` on Linux or the agent version in Windows installed programs.
- Look for IAM principals that can call `ssm:StartSession` with the AWS-StartPortForwardingSessionToRemoteHost document.

## Fix

- Upgrade SSM Agent to `3.3.4851.0` or later on all managed nodes.
- Patch any forked or derivative SSM Agent code with the same fix.
- Until upgraded, scope `ssm:StartSession` and SSM document permissions so untrusted principals cannot start remote-host port-forwarding sessions.

## Mitigated for you by

- Team (workaround): covers Untrusted principals starting remote-host port-forwarding sessions via the AWS-StartPortForwardingSessionToRemoteHost document Limits: none stated Still: Restrict ssm:StartSession IAM permissions and SSM document permissions so untrusted principals cannot start remote-host port-forwarding sessions, until SSM Agent is upgraded to 3.3.4851.0 https://aws.amazon.com/security/security-bulletins/rss/2026-107-aws/

## Timeline

- 2026-10-24T19:28:15+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-107-aws/ — AWS: CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

## Documents

- [advisory] AWS: CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent https://aws.amazon.com/security/security-bulletins/rss/2026-107-aws/

## From the sources

CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

### CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent

Bulletin ID: 2026-107-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 11:30 AM PDT

Description:

AWS Systems Manager Agent (SSM Agent) is software that runs on managed nodes (EC2 instances, on-premises servers, and other supported machines) and processes requests from the AWS Systems Manager service, enabling capabilities including Session Manager port forwarding to remote hosts. We identified CVE-2026-89049, a server-side request forgery issue in the remote-host port forwarding functionality. Due to improper validation of equivalent address representations, an authenticated user with port-forwarding permission could bypass the remote destination denylist and reach link-local endpoints, potentially obtaining the managed instance's temporary IAM role credentials and acting with that role's permissions from outside the instance.

Impacted versions: < 3.3.4851.0 (all versions supporting remote-host port forwarding)

Resolution:

This issue has been addressed in SSM Agent version 3.3.4851.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

Until the agent is upgraded, restrict use of the AWS-StartPortForwardingSessionToRemoteHost document by scoping ssm:StartSession IAM permissions and SSM document permissions so that untrusted principals cannot start remote-host port-forwarding sessions.

References:

- CVE-2026-89049
- GHSA-w9jw-h72g-6hxc

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_