Can restricted SSM permissions lead to root file writes on EC2?
AWS patches a path traversal flaw in the Systems Manager Agent that allows authenticated users to write files as root outside intended directories.
Key points
- CVE-2026-81849 affects amazon-ssm-agent versions 2.0.767.0 through 3.3.4364.0
- The flaw allows arbitrary file writes with root privileges via crafted S3 keys
- AWS released version 3.3.4515.0 to address the vulnerability
The short version
- An authenticated user with limited ssm:SendCommand permission can exploit the flaw
- The issue exists in the aws:downloadContent plugin of the agent
- Upgrading to version 3.3.4515.0 or later resolves the security risk
The details
AWS published a security bulletin on 28 August 2026 regarding CVE-2026-81849. The vulnerability resides in the aws:downloadContent plugin within amazon-ssm-agent. This agent runs on Amazon EC2 instances, edge devices, on-premises servers, and virtual machines. It enables Systems Manager to update, manage, and configure these resources. The flaw involves an improper limitation of a pathname to a restricted directory.
This allows an authenticated remote user to write arbitrary files outside the intended download directory. The user must have ssm:SendCommand permission restricted to the AWS-DownloadContent document. They achieve this by using crafted object keys in the S3 source. The writes occur with root privileges. This could lead to arbitrary code execution if specific sensitive files are overwritten.
The context
The issue affects amazon-ssm-agent versions from 2.0.767.0 up to 3.3.4364.0. AWS classified the bulletin as important, requiring attention. The vendor addressed the issue in version 3.3.4515.0. Customers are advised to upgrade to this version or later. The bulletin also recommends ensuring any forked or derivative code is patched. Wareeq Shile collaborated on the issue through the coordinated vulnerability disclosure process. The last update to the bulletin was on 30 September 2026.
Next steps
- Verify current amazon-ssm-agent versions on all managed instances
- Upgrade to version 3.3.4515.0 or later immediately
- Check for forked or derivative code that may need patching
- Review IAM permissions for ssm:SendCommand usage
What defenders should look for
Teams usually monitor for unexpected file creation events in system directories. Look for writes occurring outside standard download paths, especially when triggered by SSM commands. Check logs for root-level file modifications initiated by the agent. Verify that S3 object keys used in download commands match expected patterns. Investigate any sudden changes to configuration or binary files. Ensure alerting covers process executions by the agent with elevated privileges. Review access logs for unusual command invocations from restricted accounts.
What to do and how to stay safe: AWS
- Audit IAM policies to ensure ssm:SendCommand permissions are strictly limited
- Monitor file system integrity for unexpected writes in critical directories
- Validate S3 object keys used in download operations for anomalies
- Keep amazon-ssm-agent updated to the latest patched version
Step-by-step guide: How Virtual Patching Works: The Mechanics Behind Inline Protection
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of amazon-ssm-agent are affected by CVE-2026-81849?
Versions from 2.0.767.0 to 3.3.4364.0 are impacted by this vulnerability.
What is the fix for this path traversal flaw?
Upgrade to amazon-ssm-agent version 3.3.4515.0 or later.
Who discovered this vulnerability?
Wareeq Shile collaborated on the issue through coordinated disclosure.
