AWS Encryption SDK for Python: Critical Key Commitment Bypass Vulnerability
AWS Encryption SDK (ESDK) for Python has a nasty security flaw (CVE-2026-6550) that lets authenticated local attackers bypass key commitment policies through a shared key cache exploit. This could result in ciphertext decryptable to multiple different plaintexts—definitely not what you want from your encryption library. You need to update immediately: grab version 3.3.1, 4.0.5, or later. Affected versions include 2.0–2.5.1, 3.0–3.3.0, and 4.0–4.0.4.
source: [aws/security-bulletin]