SSRF Vulnerability in SSM Agent Exposes EC2 Metadata to Remote Forwarding Exploits

Amazon Web Services published security bulletin 2026-107-AWS disclosing CVE-2026-89049, a critical server-side request forgery (SSRF) flaw in AWS Systems Manager Agent (SSM Agent) affecting versions prior to 3.3.4851.0. The vulnerability stems from improper validation of equivalent IP address representations within the remote-host port forwarding feature of Session Manager. Under vulnerable configurations, an authenticated caller permitted to initiate remote-host port forwarding sessions could circumvent destination denylists and route traffic to link-local endpoints, notably the EC2 Instance Metadata Service (IMDS), potentially extracting temporary IAM instance profile credentials. The implications for enterprise AWS architectures are substantial. SSM Agent is installed by default across millions of EC2 instances and hybrid workloads to manage access and eliminate the operational need for open inbound SSH ports or bastion hosts. When administrative tooling provides a pathway to pivot into local metadata endpoints, the assumed identity boundaries of compute nodes collapse. An attacker possessing low-privilege access with SSM session initiation rights could elevate their reach across cloud resources by hijacking the target node's IAM role from outside the instance. This incident reinforces an ongoing industry shift toward zero-trust validation within agent runtimes and management planes. Cloud-native architectures increasingly rely on agents operating with privileged system access to broker tunnels and administrative sessions. However, relying on IP denylists for SSRF prevention remains notoriously fragile due to alternative numeric, octal, hexadecimal, or IPv6 representations. It underscores why platform engineering teams must deploy layered defenses—such as enforcing IMDSv2 with strict hop limits, restricting link-local networking, and practicing least privilege at the IAM policy level—rather than treating agent-level filtering as an infallible boundary. Practitioners should immediately verify that managed instances across all AWS accounts and regions update SSM Agent to version 3.3.4851.0 or newer. Organizations unable to roll out immediate fleet-wide updates must implement compensating IAM controls. Specifically, administrators should restrict policies granting `ssm:StartSession` across the `AWS-StartPortForwardingSessionToRemoteHost` document, ensuring untrusted identities cannot trigger remote-host port forwarding until patches are deployed.