AWS Instance Metadata Service

The 169.254.169.254 link-local endpoint named in the writeup as a target that can expose IAM role credentials to a request-forgery primitive.

Known aliases

instance metadata service

Current stories

buildConfirmed3 publishers

Zenity Labs: one prompt to a public AgentCore agent could return temporary credentials tied to a default role not scoped to that agent

Zenity Labs says one prompt to a public Bedrock AgentCore agent returned credentials for a role scoped to every agent in the account and region. AWS had removed the wider default permissions by September 29, 2026, but roles a team copied or widened sit in its own account.

Publishers:dev.to finance.yahoo.com labs.zenity.io zenity.io

Perspective Coverage

4 publishers

Builder: Builder 41%
Operator: Operator 41%
Investor: Investor 18%

Reality

Evidence55
Adoption: Not scored
Hype gap+30
Incentives60
Confidence58

buildOne report1 publisher

One prompt to one exposed AgentCore agent reached every agent in the region, Zenity Labs found

Zenity Labs showed that one prompt to one exposed Bedrock AgentCore agent could take over every AgentCore agent in the same AWS account and region. The reach came from a broad default execution role, and narrowing it is the step teams control.

Publishers:dev.to

Reality

Evidence50
Adoption: Not scored
Hype gap+10
Incentives: Not scored
Confidence48

buildConfirmed2 publishers

AgentCore's region-wide default role let one public agent's stolen credentials reach every agent in the account

Zenity Labs found that one prompt to a single public Amazon Bedrock AgentCore agent could take over every agent in the same AWS account and region. Zenity says the partial fix from AWS still leaves teams to cut each agent's role down to minimal access by hand.

Publishers:the-decoder.com thenextweb.com

Reality

Evidence50
Adoption: Not scored
Hype gap+15
Incentives65
Confidence55

buildOne report1 publisher

Metadata discovery turns an MCP client into an unauthenticated fetch primitive

A researcher found the SSRF guard sitting on the credential-submission side of an MCP auth SDK while the .well-known discovery fetch ran unchecked from the public entry point, which is the wrong end of the flow to protect.

Publishers:dev.to

Reality

Evidence45
Adoption: Not scored
Hype gap+28
Incentives55
Confidence42

leadershipOne report1 publisher

MLflow's default server hands out cloud credentials to anyone who asks nicely

A GitHub advisory describes an unauthenticated, full-read SSRF in the default MLflow tracking server that reaches the cloud metadata endpoint and reflects the response back to the caller.

Publishers:github.com

Reality

Evidence78
Adoption: Not scored
Hype gap+16
Incentives42
Confidence68