CVE-2026-6550 Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python
An authenticated local attacker can bypass key commitment policies via a shared key cache, allowing ciphertext to decrypt to multiple plaintexts.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-6550?
CVE-2026-6550 is a medium-severity vulnerability in AWS Encryption SDK for Python, published on 20 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts.
To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.
Weakness: CWE-757
Which versions are affected by CVE-2026-6550?
5 open source packages ship an affected version, including aws-encryption-sdk.
| Package | Affected | Fixed in |
|---|---|---|
aws-encryption-sdk PyPI | From 2.0.0 | 3.3.1, 4.0.5 |
aws-encryption-sdk PyPI | From 2.0.0 | 3.3.1 |
aws-encryption-sdk PyPI | From 2.0.0 | 3.3.1 |
aws-encryption-sdk PyPI | From 4.0.0 | 4.0.5 |
aws-encryption-sdk PyPI | From 4.0.0 | 4.0.5 |
How do I fix CVE-2026-6550?
Upgrade aws-encryption-sdk to a fixed version for your release line: 3.3.1 or 4.0.5.
Is CVE-2026-6550 being exploited?
There is no known exploitation of CVE-2026-6550 in the wild and no public exploit code.
Sources
Also known as GHSA-v638-38fc-rhfv, PYSEC-2026-2387.