This vulnerability (CVE-2026-6550) affects the AWS Encryption SDK for Python versions before 3.3.1 and 4.0.5. It is caused by a selection of a less-secure cryptographic algorithm during negotiation in the caching layer, classified as CWE-757 (Selection of Less-Secure Algorithm). An authenticated local threat actor could exploit this to bypass key commitment policy enforcement through a shared key cache, leading to ciphertexts that can be decrypted into multiple different plaintexts. The issue is fixed in versions 3.3.1 and 4.0.5 and above. AWS manages remediation for this cloud-hosted service, and users should upgrade accordingly.

The vulnerability allows an authenticated local attacker to bypass key commitment policy enforcement, potentially causing ciphertext to decrypt into multiple different plaintexts. This impacts the integrity of encrypted data but does not affect confidentiality or availability. The CVSS 3.1 base score is 4.7 (medium severity), reflecting the requirement for local access with high attack complexity and low privileges.

A fix is available. Users should upgrade the AWS Encryption SDK for Python to version 3.3.1, 4.0.5, or later. Since this is a cloud-hosted service, AWS manages remediation on their side, but client-side upgrades are necessary to fully mitigate the vulnerability. Refer to the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-017-aws/ for detailed guidance.