CVE-2026-6550

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.

Score

CVSS 4.0 5.7 Medium

Status

Awaiting Analysis - ff89ba41-3aa1-4d27-914a-91399e9639e5

Published

2026-04-20

Last modified

2026-10-26

Weaknesses

CWE-757

Affected products

• Aws Encryption Sdk For Python (Aws)

References

• https://aws.amazon.com/security/security-bulletins/2026-017-aws/
• https://github.com/aws/aws-encryption-sdk-python/releases/tag/v4.0.5
• https://github.com/aws/aws-encryption-sdk-python/releases/tag/v3.3.1
• https://github.com/aws/aws-encryption-sdk-python/security/advisories/GHSA-v638-38fc-rhfv