CVE-2026-6550CWE-757

Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python

Medium · published April 20, 2026

CVSS v4.0
5.7
EPSS
0%
Percentile
0.8
In the wild
Unconfirmed
What it is

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts.

To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.

The record
Technical detail
CVSS v4.0
5.7 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00099 · 0.8th percentile
Weakness
CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
Published
2026-04-20T19:20Z
EPSS history
Timeline
  • 20 APR 19:20Z
    Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python
    cvelistv5