CVE-2026-6550
Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 5.7
- CVSS vector
- CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.10%
- CWE
- CWE-757
- Published
- 2026-04-20
- Last modified
- 2026-04-20
Affected products
- AWS AWS Encryption SDK for Python
- AWS AWS Encryption SDK for Python
- AWS AWS Encryption SDK for Python
Weakness type
Related vulnerabilities
- CVE-2026-72889 — Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify
- CVE-2026-72887 — Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token
- CVE-2026-18691 — Improper Authentication in MongoDB Intra-Cluster Connections Allows Credential Exposure
- CVE-2026-55953 — TLS 1.2 and DTLS client accepts unoffered anonymous cipher suite, bypassing server authentication
- CVE-2026-4942 — IBM i is Affected by Algorithm Downgrade in Transport Layer Security []
- CVE-2026-53712 — SCRAM: Silent channel-binding authentication downgrade via unsupported certificate algorithms
- CVE-2026-48747 — Symfony: Mailomat Mailer Webhook Parser Reads the HMAC Algorithm from the Request: Signature Algorithm Downgrade
- CVE-2026-54780 — CoreWCF: WS-Security Reference DigestMethod Algorithm-Suite Bypass