important · Privilege — AWS
Delegated SSM port forwarding can expose a managed instance’s IAM role credentials.
Affects
AWS Systems Manager Agent, management software running on EC2 instances, on-premises servers, and other managed nodes.
A permitted port-forwarding user can encode a link-local address in a form the agent’s denylist misses, tunnel to metadata, and use the retrieved instance-profile credentials outside the node.
Detail and 3 sources
Updated agents canonicalize addresses and add credential endpoints to the denylist.
Sources
Code / PoCServer-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager AgentCode / PoCRelease Amazon SSM Agent - Release 3.3.4851.0 - 2026-07-13 · aws/amazon-ssm-agentVendorCVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent