Threat database

CVE-2026-89049 is a critical server-side request forgery (SSRF) vulnerability in Amazon AWS Systems Manager Agent (SSM Agent) versions before 3.3.4851.0. It arises from improper validation of equivalent address representations in the port forwarding functionality, allowing an authenticated remote user to bypass the remote destination denylist and access link-local endpoints. This can lead to unauthorized retrieval of temporary IAM role credentials from a managed instance, enabling actions with those permissions from outside the instance. The issue is fixed in version 3.3.4851.0 and later.