Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python

Bulletin ID: 2026-017-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 04/20/2026 9:15 AM PDT   Description: AWS Encryption SDK (ESDK) for Python is a client-side encryption library. We identified CVE-2026-6550 , which describes an issue with a key commitment policy bypass via shared key cache. Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. Impacted versions: From 2.0 to 2.5.1 From 3.0 to 3.3.0 From 4.0 to 4.0.4 Resolution: This issue has been addressed in ESDK for Python versions 3.3.1 and 4.0.5. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds: If a customer requires operating multiple instances of the Python ESDK each with differently configured key commitment policies, they must not share a key cache. References: CVE-2026-6550 GHSA-v638-38fc-rhfv Acknowledgement: We would like to thank 1seal.org for collaborating on this issue through the coordinated vulnerability disclosure process. Please email aws-security@amazon.com with any security questions or concerns.   "},"metadata":{"tags":[]}},{"fields":{"patternBoolean2":"false","id":"ams#rt-rich-textc2#pattern-data"},"metadata":{"tags":[{"name":"pattern-data","description":"Default pattern data","id":"ams#rt-rich-textc2#pattern-data","namespaceId":"rt-rich-text"}]}}]},"metadata":{"auth":{},"testAttributes":{}},"context":{"page":{"pageUrl":"https://aws.amazon.com/security/security-bulletins/2026-017-aws/"},"contentType":"page","environment":{"stage":"prod","region":"us-west-2"},"sdkVersion":"2.0.27"},"refMap":{"manifest.js":"cda3e8d042","rt-rich-text.js":"5043b0a87f","rt-rich-text.rtl.css":"6a04028f86","rt-rich-text.css":"98f5a6aee4","rt-rich-text.css.js":"3d619cc2e1","rt-rich-text.rtl.css.js":"ccdb945d3e"},"settings":{"templateMappings":{"patternHeading":"patternHeading","patternSubheading":"patternSubheading","patternDark":"patternBoolean2","title":"itemHeading","bodyText":"itemLongLoc"}}} CVE-2026-6550 - Key commitment policy bypass via shared key cache in AWS Encryption SDK for Python Bulletin ID: 2026-017-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 04/20/2026 9:15 AM PDT   Description: AWS Encryption SDK (ESDK) for Python is a client-side encryption library. We identified CVE-2026-6550 , which describes an issue with a key commitment policy bypass via shared key cache. Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. Impacted versions: From 2.0 to 2.5.1 From 3.0 to 3.3.0 From 4.0 to 4.0.4 Resolution: This issue has been addressed in ESDK for Python versions 3.3.1 and 4.0.5. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. Workarounds: If a customer requires operating multiple instances of the Python ESDK each with differently configured key commitment policies, they must not share a key cache. References: CVE-2026-6550 GHSA-v638-38fc-rhfv Acknowledgement: We would like to thank 1seal.org for collaborating on this issue through the coordinated vulnerability disclosure process. Please email aws-security@amazon.com with any security questions or concerns.   {"data":{"items":[{"fields":{"footer":"{ "createAccountButtonLabel": "Create an AWS account", "createAccountButtonURL": "https://signin.aws.amaz

Severity from

no source yet

• aws.amazon.com/security/security-bulletins/rss/2026-017-aws/
• www.cve.org/CVERecord?id=CVE-2026-6550