CVE-2026-6550: Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.

CVE-2026-6550 · Severity: high · CVSS 4.7 · Published 2026-04-20

The AWS Encryption SDK for Python is a library used by developers to encrypt and decrypt data within their applications. A vulnerability in how the library handles cached encryption keys could allow a local user to bypass security policies intended to ensure a single ciphertext only corresponds to a single original message. This could lead to a situation where different users see different data when decrypting the same encrypted file, potentially compromising data integrity and trust.

Technologies: Amazon AWS, aws-encryption-sdk (PyPI). Vendors: Amazon, AWS, PyPI.

Quick answers

Is CVE-2026-6550 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-6550 being exploited in the wild.
How severe is CVE-2026-6550?
High severity, with a CVSS score of 4.7, published 20 April 2026.
Which products and versions are affected?
AWS Encryption SDK for Python 2.0 - 2.5.1, 3.0 - 3.3.0, 4.0 - 4.0.4; aws-encryption-sdk (PyPI) ECOSYSTEM:introduced=2.0.0,fixed=3.3.1, ECOSYSTEM:introduced=2.0.0,fixed=3.3.1,introduced=4.0.0,fixed=4.0.5.
Is there a fix for CVE-2026-6550?
Yes. aws-encryption-sdk (PyPI): upgrade to 3.3.1, 4.0.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-6550 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-6550?
Check whether you run Amazon AWS, AWS Encryption SDK for Python or aws-encryption-sdk (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • aws-encryption-sdk (PyPI): upgrade to 3.3.1, 4.0.5 or later
    pip install "aws-encryption-sdk>=4.0.5"

Technical details

A cryptographic algorithm downgrade vulnerability exists in the caching layer of the AWS Encryption SDK (ESDK) for Python. When multiple instances of the ESDK share a key cache but have different key commitment policies, the library may fail to enforce the stricter policy. This allows an authenticated local threat actor to bypass key commitment enforcement, leading to a 'key commitment' failure where a single ciphertext can be decrypted into multiple different plaintexts depending on the key used. The issue is resolved in versions 3.3.1 and 4.0.5. Users who cannot upgrade should avoid sharing key caches between ESDK instances with different security policies.

Affected products

  • AWS Encryption SDK for Python 2.0 - 2.5.1, 3.0 - 3.3.0, 4.0 - 4.0.4

Identifiers

  • CVE-2026-6550
  • GHSA-v638-38fc-rhfv
  • PYSEC-2026-2387

Timeline

  • 2026-04-20: disclosed
  • 2026-04-20: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.