How to Use CloudTrail to Check Whether You Were Affected by the AWS SSM Agent Vulnerability (CVE-2026-89049)

by Akira Nishikawa

The most severe AWS bulletin of the week is a CVSS 9.9 SSRF in SSM Agent. An authenticated principal calling AWS-StartPortForwardingSessionToRemoteHost gets past the destination denylist with an equivalent representation of a link-local address, then reaches IMDS and can steal the instance role credentials remotely. Akira does a good job of explaining the implications of the issue and how to look for exploitation but in my opinion misses the most important detail: what on earth does "equivalent representation of a link-local address" mean? Not explaining "a link-local address, or an unusual representation of one" makes it hard to implement the detection.

Off Guard: Breaking LiteLLM from authentication bypass to cloud compromise

by Amitai Cohen (https://www.linkedin.com/in/amitaico/) and Yaara Shriki

LiteLLM is the most popular open-source LLM gateway, a self-hosted proxy for your model providers. On AWS that's usually EKS or EC2 in your VPC, fronting Bedrock under an instance role. Its admin credential is called the master key, and sk-1234 is still the default for Docker Compose and pip installs. The homies at Wiz scanned 3,074 internet-facing deployments and found 9.6% accept sk-1234 or no key at all. They also found bugs. The MCP endpoint lets anyone call the tools the proxy is connected to (CVE-2026-59822), and any valid API key ran Python as root in the container (CVE-2026-59821). Both are patched. A third won't be; LiteLLM trusts admins by design. The pass-through endpoint does no URL validation, so a master key holder can aim it at 169.254.169.254 and read back the instance role credentials. x-pass- headers forward with the prefix stripped, so IMDSv2 won't save you. Yay.

Machine speed, hold the AI: Hand-rolled marimo CVE-2026-39987 exploit

by Sysdig

Sysdig instrumented a vulnerable marimo container and watched an actor work it. marimo is a Python notebook, and it usually runs on ML pipeline hosts with GPUs, big datasets and AWS credentials sitting right there. CVE-2026-39987 is an RCE in its unauthenticated WebSocket terminal. One actor went from that WebSocket to a shell on a bastion host in eight seconds, stealing the host's credentials and calling secretsmanager:GetSecretValue for the bastion's SSH key. Eight seconds is the speed everyone now thinks of as AI, and this wasn't. Sysdig had planted a file that tries to make an LLM echo a hidden marker. The actor read it twice, never echoed, then hand-wrote 850+ commands over nine hours.