CVE-2026-33467
Improper Signature Verification in Elastic Package Registry Enables Tampering
Publication date: 2026-04-28
Last updated on: 2026-05-05
Assigner: Elastic
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| elastic | elastic_package_registry | to 1.38.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-347 | The product does not verify, or incorrectly verifies, the cryptographic signature for data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an Improper Verification of Cryptographic Signature (CWE-347) in the Elastic Package Registry. It means that the system does not correctly verify the cryptographic signature of packages. As a result, an attacker who can intercept network traffic or influence the contents served to a self-hosted registry could substitute a tampered package without the integrity check detecting the alteration.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves improper verification of cryptographic signatures in the Elastic Package Registry, which could allow an attacker to substitute tampered packages without detection.
Such a flaw could potentially impact compliance with standards and regulations that require data integrity and protection against unauthorized modification, such as GDPR and HIPAA.
Specifically, the inability to ensure package integrity might lead to unauthorized changes in software components, which could compromise the security and reliability of systems handling sensitive data.
However, the provided information does not explicitly detail the direct effects on compliance with these regulations.
How can this vulnerability impact me? :
The vulnerability can allow an attacker to deliver tampered packages to your Elastic Package Registry without detection. This could lead to the installation of malicious or altered software components, potentially compromising the integrity of your system or applications that rely on these packages.