CVE-2026-33467
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
In Elastic Package Registry, a vulnerability exists due to improper verification of cryptographic signature (CWE-347). An attacker positioned to intercept network traffic or influence contents served to a self-hosted registry can substitute a tampered package without integrity check failing.
Risk Assessment
The organization may be at risk of receiving tampered packages, potentially leading to system integrity compromise.
Recommendation
It is recommended to update Elastic Package Registry to a version containing the signature verification fix and to use secure network connections.
Original NVD description (English source)
Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed.