AWS Systems Manager Agent (SSM Agent) Session Manager remote-host port forwarding is vulnerable to SSRF due to improper validation of equivalent address representations, letting an authenticated user with port-forwarding permission bypass the remote destination denylist and reach link-local endpoints. Impacted: < 3.3.4851.0. Exposure may include temporary IAM role credentials. Upgrade to 3.3.4851.0+ to mitigate.