AWS Systems Manager Agent Flaw Lets Port Forwarding Users Reach Instance Credentials
AWS has published security bulletin 2026-107-AWS covering CVE-2026-89049, a server-side request forgery flaw in the AWS Systems Manager Agent. The agent runs on managed nodes such as EC2 instances and on-premises servers, processing requests from the Systems Manager service and enabling features including Session Manager port forwarding to remote hosts. The issue sits in that remote-host port forwarding functionality and affects all agent versions below 3.3.4851.0 that support the feature. AWS rates the bulletin Important and released a fixed agent version alongside the disclosure on 9 October 2026.
The agent maintains a denylist intended to stop port-forwarding sessions from reaching restricted destinations. The vendor states that this validation handles equivalent address representations improperly, so the same endpoint written a different way is not matched. An authenticated user who already holds port-forwarding permission can therefore craft a destination that slips past the denylist and resolves to a link-local endpoint. From there the session can reach the instance metadata service and retrieve the managed node's temporary IAM role credentials.
The consequence described by AWS is that those credentials can be used from outside the instance, letting the holder act with that role's permissions anywhere the role is accepted. That breaks the assumption that an instance role is only usable from the node it is bound to, and it converts a narrow port-forwarding privilege into access to whatever that role can touch. Exposure scales with how widely remote-host port forwarding is granted and how permissive the attached instance roles are, and forked or derivative agent code carries the same flaw until it incorporates the fix. FIRST EPSS places the probability of exploitation in the next 30 days at 0.7 percent, and the bulletin does not report any observed exploitation.
Attack Surface
Cloud Service, System Management Service, Remote Access Service
Tactics
Credential Access, Defense Evasion, Privilege Escalation, Lateral Movement
Techniques
- T1552.005 – Unsecured Credentials: Cloud Instance Metadata API
- T1078.004 – Valid Accounts: Cloud Accounts
- T1572 – Protocol Tunneling
- T1550.001 – Use Alternate Authentication Material: Application Access Token
SuperPRO's Threat Countermeasures Procedures
- Upgrade AWS Systems Manager Agent to version 3.3.4851.0 or later on every managed node (EC2 instances, on-premises and hybrid-activated servers); roll it out fleet-wide using the AWS-UpdateSSMAgent document via a State Manager association rather than per-host updates.
- Until the agent is upgraded, restrict use of the AWS-StartPortForwardingSessionToRemoteHost document by scoping ssm:StartSession IAM permissions and SSM document permissions so that untrusted principals cannot start remote-host port-forwarding sessions, as directed in bulletin 2026-107-AWS.
- Identify any forked or derivative builds of the open-source SSM Agent in your estate and rebuild them against the 3.3.4851.0 code containing the address-validation fix for CVE-2026-89049.
- Confirm remediation state per node by checking the AgentVersion reported for each managed node in Systems Manager (ssm describe-instance-information) and treating any node below 3.3.4851.0 that supports remote-host port forwarding as still carrying CVE-2026-89049.
- Narrow the blast radius of the AWS-StartPortForwardingSessionToRemoteHost document by removing its SSM document sharing from accounts and principals that have no operational need for remote-host forwarding, in line with the permission-scoping guidance in bulletin 2026-107-AWS.
- Re-run the AWS-UpdateSSMAgent document against any managed node that still reports an agent below 3.3.4851.0 after the initial rollout, including on-premises and hybrid-activated servers, so no node is left on a pre-fix agent build.
