Description

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent (SSM Agent) before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote destination denylist and reach link-local endpoints, potentially obtaining the temporary IAM role credentials of a managed instance and acting with that role's permissions from outside the instance, via a crafted destination host value that uses an alternate representation of a denied link-local address. To remediate this issue, users should upgrade to version 3.3.4851.0 or later.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-09-10T19:17:42.373Z",
  "pubdate": "2026-09-10T19:17:42.373Z",
  "executiveSummary": "Amazon AWS Systems Manager Agent (SSM Agent) versions prior to 3.3.4851.0 contain a Server-Side Request Forgery (SSRF) vulnerability within its port forwarding functionality.\nThe vulnerability stems from improper validation of destination host addresses, which allows an authenticated remote user to bypass established denylists.\nBy leveraging alternate representations of restricted link-local addresses, an attacker can force the agent to establish connections to unauthorized endpoints.\nThis flaw presents a significant security risk, as successful exploitation enables an attacker to reach the Amazon EC2 Instance Metadata Service (IMDS).\nBy accessing IMDS, an attacker can exfiltrate temporary AWS Identity and Access Management (IAM) role credentials assigned to the managed instance.\nOnce credentials are obtained, the attacker can impersonate the instance and perform unauthorized actions within the AWS environment consistent with the instance's IAM permissions.\nThis vulnerability requires an authenticated attacker with access to the agent's port forwarding capabilities to initiate the malicious request.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient canonicalization and validation of the destination host address during the port forwarding process in AWS SSM Agent. The agent is designed to prevent connections to restricted network ranges, specifically link-local addresses such as 169.254.169.254, which are used to access the Instance Metadata Service (IMDS).\nThe vulnerability is exposed through the port forwarding to remote hosts functionality. When a user initiates a port forwarding request, the SSM Agent evaluates the destination host against a denylist. However, the agent fails to account for equivalent address representations—such as various IP encoding formats or alternative notations—that the underlying network stack interprets as the forbidden link-local address. By crafting a request with an obfuscated or non-standard representation of the target address, an attacker can bypass the agent's filter logic.\nThe attack flow proceeds as follows: First, an authenticated remote user initiates a port forwarding session via the SSM Agent. Second, the attacker provides a crafted destination host value that represents the link-local address 169.254.169.254 but is not caught by the agent’s denylist checks. Third, the SSM Agent fails to normalize this input and proceeds to establish a connection to the unintended destination. Fourth, the request is forwarded to the local metadata service endpoint. Fifth, the metadata service responds to the request, and the SSM Agent relays the response back to the attacker.\nThe post-exploitation impact is severe. By communicating with the IMDS, an attacker can retrieve security credentials associated with the instance's IAM role. With these temporary credentials, the attacker can execute AWS API calls from outside the instance, effectively pivoting from a compromise of the SSM Agent to an escalation of privileges within the AWS cloud environment. The vulnerability affects all platforms supported by SSM Agent versions prior to 3.3.4851.0. Because the agent must successfully establish the connection, this vulnerability requires an authenticated actor, though the privilege requirements to trigger the forwarding request are inherently bound to the access control policies governing the use of SSM features on the managed instance."
}