Dashboard / CVE-2026-6550

CVE-2026-6550

MEDIUM
MEDIUM Priority: 0.01 BB Relevance: 26/100
Published: 2026-04-20 Modified: 2026-10-26 First seen: 2026-10-29 Status: active

Attack Surface

No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: High
PR: Low
UI: None
S: X
AT: Present
VC: None
VI: High
VA: None

Description

Cryptographic algorithm downgrade in the caching layer of Amazon AWS Encryption SDK for Python before version 3.3.1 and before version 4.0.5 might allow an authenticated local threat actor to bypass key commitment policy enforcement via a shared key cache, resulting in ciphertext that can be decrypted to multiple different plaintexts. To remediate this issue, users should upgrade to version 3.3.1, 4.0.5 or above.

Weakness Classification (1)

References & Advisories (4)

Bug Bounty Relevance

26 / 100
✓ No user interaction

CVSS Score

5.7 / 10.0 v4.0
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.10%
Raw Score 0.000960
Percentile 0.7%
Date 2026-10-29

EPSS Trend

2026-10-29
0.00096
2026-10-28
0.00096

Intelligence Sources

nvd ref →

External Links