AWS CVE-2026-6550

Exploitation requires three specific conditions to be met: (1) the application must use AWS Encryption SDK for Python versions 2.5.1, 3.3.0, or 4.0.4 or earlier; (2) the application must have key caching enabled and share the cache across multiple authenticated users, multiple requests, or multiple decryption contexts; (3) the attacker must have authenticated credentials to access the application and local system access to interact with the cached key material or trigger decryption operations. The vulnerability cannot be exploited against applications with caching disabled, single-user applications, or single-request cache isolation. Authentication is mandatory (PR:L in CVSS vector); unauthenticated remote exploitation is not possible.

This vulnerability presents moderate real-world risk despite the moderate CVSS score of 5.7. The attack requires local access (AV:L), high attack complexity (AC:H), and low privileges (PR:L) with a persistent attack timing requirement (AT:P), all of which significantly constrain exploitation compared to network-based attacks. However, the impact is severe: integrity is highly compromised (VI:H), meaning confidentiality guarantees of encrypted data are fundamentally broken for affected versions in shared-cache environments. The CVSS score of 5.7 appropriately reflects these constraints - the vulnerability is not trivial but is bounded by authentication and local access requirements. Real-world risk depends on deployment context: applications using shared key caches in multi-user environments (shared container instances, serverless platforms with warm starts, or shared worker pools) face higher risk than single-user deployments. The existence of vendor patches and the requirement for authenticated access suggest this is a targeted rather than widespread exploitation risk. No EPSS score, active exploitation (KEV), or public POC data are provided, indicating this remains a patch-adoption priority rather than an emergency response scenario.

An authenticated attacker with local access to a system running AWS Encryption SDK for Python (e.g., a compromised application process, containerized workload on shared infrastructure, or authorized but malicious employee) exploits the shared key cache by manipulating which cached key is selected during decryption operations. By sending two identical ciphertexts to the vulnerable library with different cache states, the attacker causes the same ciphertext to decrypt to two different plaintexts, breaking the cryptographic binding and potentially extracting sensitive data that was encrypted under a different key than the one used in the decryption attempt.