CVE-2026-81849: Amazon SSM Agent Path Traversal Vulnerability

CVE-2026-81849 Overview

CVE-2026-81849 is a path traversal vulnerability [CWE-23] in the aws:downloadContent plugin of amazon-ssm-agent versions before 3.3.4515.0. The flaw allows an authenticated remote user with ssm:SendCommand permission scoped to the AWS-DownloadContent document to write arbitrary files outside the intended download directory. Because the SSM agent runs with root privileges on managed instances, an attacker can overwrite sensitive files and achieve arbitrary code execution as root. Exploitation relies on crafted S3 object keys that traverse the filesystem when the plugin resolves the destination path.

Critical Impact
An authenticated AWS principal with minimally scoped AWS-DownloadContent permissions can write files as root on any managed EC2 or hybrid instance, enabling full host compromise.

Affected Products

amazon-ssm-agent versions prior to 3.3.4515.0
Amazon EC2 instances running vulnerable SSM Agent builds
Hybrid and on-premises servers registered with AWS Systems Manager

Discovery Timeline

2026-08-28 - CVE-2026-81849 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-81849

Vulnerability Analysis

The aws:downloadContent plugin retrieves content from an S3 source and writes it to a destination directory on the managed instance. The plugin fails to properly canonicalize or restrict the destination path derived from the S3 object key. When an object key contains directory traversal sequences such as ../, the resolved write path escapes the intended download directory. Because amazon-ssm-agent executes as root on Linux hosts, the write occurs with root privileges anywhere on the filesystem. Overwriting files such as /etc/cron.d/ entries, /root/.ssh/authorized_keys, or shared library paths converts arbitrary file write into arbitrary code execution as root.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-23]. The plugin concatenates the S3 object key with the target directory without validating that the resolved absolute path remains within the intended base directory. Path canonicalization and boundary checks are absent from the download code path.

Attack Vector

An attacker requires valid AWS credentials with ssm:SendCommand permission for the AWS-DownloadContent document targeting a vulnerable instance. The attacker controls an S3 bucket containing objects whose keys embed traversal sequences. When the SSM agent executes the document, it retrieves the malicious objects and writes them to attacker-chosen filesystem locations as root. No user interaction on the target host is required. See the AWS Security Bulletin 2026-091 for vendor details.

Detection Methods for CVE-2026-81849

Indicators of Compromise

Unexpected files written outside the standard SSM download directory /var/lib/amazon/ssm/
CloudTrail SendCommand events invoking AWS-DownloadContent from unusual principals or with S3 sources outside approved buckets
New or modified files in sensitive paths such as /etc/cron.d/, /etc/ld.so.preload, /root/.ssh/authorized_keys, or /usr/lib/systemd/system/

Detection Strategies

Correlate CloudTrail ssm:SendCommand API events with the invoked document name and S3 source URI, and alert on object keys containing ../ or absolute path fragments
Monitor SSM agent logs (/var/log/amazon/ssm/amazon-ssm-agent.log) for downloadContent plugin activity referencing paths outside configured working directories
Baseline file integrity for critical system paths on all SSM-managed instances and alert on writes performed by the amazon-ssm-agent process

Monitoring Recommendations

Enable AWS CloudTrail data events for S3 buckets referenced by SSM automation, and ingest SSM Agent logs into a centralized logging pipeline
Enforce least privilege on IAM identities that hold ssm:SendCommand, and audit any principals scoped to AWS-DownloadContent
Track the installed amazon-ssm-agent version across the fleet via AWS Systems Manager Inventory and flag hosts below 3.3.4515.0

How to Mitigate CVE-2026-81849

Immediate Actions Required

Upgrade amazon-ssm-agent to version 3.3.4515.0 or later on all managed EC2, hybrid, and on-premises instances
Review IAM policies granting ssm:SendCommand on AWS-DownloadContent and revoke unnecessary access
Restrict S3 source buckets referenced by SSM documents to trusted, access-controlled buckets only

Patch Information

AWS resolved the vulnerability in amazon-ssm-agent release 3.3.4515.0. Refer to the GitHub Release for SSM Agent 3.3.4515.0 for release artifacts and to the AWS Security Bulletin 2026-091 for vendor guidance. Use SSM State Manager or the AWS-UpdateSSMAgent document to roll the update across the fleet.

Workarounds

Deny ssm:SendCommand for the AWS-DownloadContent document via IAM policy or Service Control Policy until agents are patched
Constrain AWS-DownloadContent invocations to specific approved S3 buckets using IAM condition keys on ssm:resourceTag and bucket ARNs
Enable file integrity monitoring on sensitive filesystem paths to detect writes originating from the SSM agent process

bash

# Verify installed SSM Agent version and upgrade if below 3.3.4515.0
sudo yum info amazon-ssm-agent | grep Version
sudo systemctl restart amazon-ssm-agent

# Example IAM condition restricting AWS-DownloadContent to approved buckets
# "Condition": { "StringEquals": { "ssm:DocumentName": "AWS-DownloadContent" },
#   "ArnEquals": { "s3:bucketArn": "arn:aws:s3:::approved-ssm-content" } }