Vulnerability · Published Apr 28, 2026 · Assigned by elastic
CVE-2026-33467Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass
Medium 5.9
In plain English
A medium-severity security flaw in Elastic Package Registry from Elastic. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/elastic/package-registry | 1.38.0 | GHSA-r727-5pf6-47r2 |
| Go | github.com/elastic/package-registry | 1.38.0 | GO-2026-5611 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Elastic | Elastic Package Registry | 0.1.0 – through 1.37.0 |
Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N