CVE-2026-6550: AWS Encryption SDK Key Commitment Policy Bypass Vulnerability
Summary
CVE-2026-6550: AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache. Affects aws-encryption-sdk across 2 version ranges.
>= 2.0.0, < 3.3.1
>= 4.0.0, < 4.0.5
Fixed in 3.3.1 or 4.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The AWS Encryption SDK for Python is a client-side encryption library designed to facilitate secure data encryption and decryption. It provides developers with tools to implement encryption in their applications, ensuring data confidentiality and integrity. However, a vulnerability exists that allows an authenticated local threat actor to bypass key commitment policy enforcement under specific conditions, potentially compromising data security.
Vulnerability Detail
The vulnerability arises from a flaw in the caching layer of the AWS Encryption SDK for Python, where a downgrade in cryptographic algorithms can occur. This allows a client with a weaker key commitment policy to encrypt data first, which then gets cached. Subsequent clients, even those with stricter policies, may inadvertently use this cached data, leading to encryption without proper key commitment. As a result, the same ciphertext could be decrypted to different plaintexts, undermining message integrity and allowing a threat actor to manipulate the decryption process.
How To Fix
Latest published version: 4.0.7 as of 23 Oct 2026
pip install --upgrade "aws-encryption-sdk==4.0.7"Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0, < 3.3.13.3.1pip install --upgrade "aws-encryption-sdk==3.3.1" -
>= 4.0.0, < 4.0.54.0.5pip install --upgrade "aws-encryption-sdk==4.0.5"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If multiple instances of the AWS Encryption SDK are required, each with different key commitment policies, do not share a key cache. This can be achieved by instantiating separate instances of CachingCryptoMaterialsManager for each client.
Conclusion
The CVE-2026-6550 vulnerability in the AWS Encryption SDK for Python poses a significant risk by allowing key commitment policy bypass under certain conditions. It is crucial for users to update to the latest versions of the SDK and implement recommended workarounds to ensure data integrity and security.
See every vulnerability recorded for aws-encryption-sdk →
FAQ
It is a client-side encryption library that helps developers implement encryption in their applications to secure sensitive data.
It allows a local threat actor to bypass key commitment policy enforcement, potentially leading to data integrity issues.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
The vulnerability can lead to message integrity being compromised, allowing unauthorized decryption of messages.
Update the AWS Encryption SDK to the latest patched versions and avoid sharing key caches between clients with different commitment policies.
References
Related vulnerabilities
Recent vulnerabilities recorded for aws-encryption-sdk.
