CVE-2026-89049 - Server-side request forgery in the Session Manager port forwarding functionality in AWS Systems Manager Agent
AWS Systems Manager ยท 2026-10-25
Actions
Technical Details
| Affected Versions | < 3.3.4851.0 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-89049 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update the SSM Agent to version 3.3.4851.0 on all managed nodes to address the server-side request forgery vulnerability (CVE-2026-89049) and prevent unauthorized access to link-local endpoints.
For Platform Teams
Deploy the SSM Agent version 3.3.4851.0 across all managed nodes to resolve the security vulnerability and ensure the integrity and security of the managed instances.
For Executives
Implement the SSM Agent update to version 3.3.4851.0 to mitigate the server-side request forgery vulnerability and protect managed instances from unauthorized access and potential credential theft.