AWS Discloses Critical SSRF Flaw in SSM Agent; CloudTrail Can Help Detect Exploitation

AWS disclosed CVE-2026-89049 on September 10, 2026, a CVSS 9.9-rated SSRF vulnerability in the AWS Systems Manager (SSM) Agent affecting versions earlier than 3.3.4851.0. The flaw resides in the remote-host port forwarding feature, allowing an authenticated user with StartPortForwardingSessionToRemoteHost permissions to bypass destination denylists using alternate representations of link-local addresses. This could enable access to the EC2 Instance Metadata Service (IMDS) and allow theft of temporary IAM role credentials usable outside the instance until expiry. The security risk is most severe when the attacker lacks shell or Run Command access to the managed instance, as the vulnerability crosses an otherwise intentional permission boundary. Security teams can use AWS CloudTrail to audit StartSession API calls — including target instance, document name, and remote host parameters — to identify potential exploitation attempts in their environments.