CVE-2026-6550 - Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python

Back Back to CVE browser

MEDIUM

Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python

Published Apr 20, 2026

5.7

MEDIUM

CVSS 4.0

EPSS 0.10%

Description

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts.

To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.

Affected products

Vendor AWS Product AWS Encryption SDK for Python Default
unaffected
- Version
  2
  Status
  affected
  Constraints
  <=2.5.1
- Version
  3
  Status
  affected
  Constraints
  <=3.3.0
- Version
  4
  Status
  affected
  Constraints
  <=4.0.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

AWS

AWS Encryption SDK for Python

unaffected

Version	Status	Constraints
2	affected	<=2.5.1
3	affected	<=3.3.0
4	affected	<=4.0.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-757

References (8)

Link	Providers	Tags
https://aws.amazon.com/security/security-bulletins/2026-017-aws		vendor-advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23943		Advisory
https://github.com/advisories/GHSA-v638-38fc-rhfv		Advisory
https://github.com/aws/aws-encryption-sdk-python/releases/tag/v3.3.1		patch
https://github.com/aws/aws-encryption-sdk-python/releases/tag/v4.0.5		patch
https://github.com/aws/aws-encryption-sdk-python/security/advisories/GHSA-v638-38fc-rhfv		third-party-advisory
https://github.com/google/security-research/security/advisories/GHSA-wqgp-vphw-hphf
https://nvd.nist.gov/vuln/detail/CVE-2026-6550