PT-2026-35818 · Elastic · Package Registry

Ismisepaul + 1 · Published 2026-04-28 · Updated 2026-05-05 · CVE-2026-33467

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Elastic Package Registry (affected versions not specified)

Description Improper Verification of Cryptographic Signature occurs in the Elastic Package Registry. This issue allows an attacker who can intercept network traffic or influence the content served to a self-hosted registry to substitute a tampered package without the integrity check failing closed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-33467

GHSA-R727-5PF6-47R2

Affected Products

Package Registry

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-33467 · Security Note
• https://osv.dev/vulnerability/GHSA-r727-5pf6-47r2 · Vendor Advisory
• https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081 · Vendor Advisory
• https://github.com/elastic/package-registry · Note
• https://t.me/cveNotify/162219 · Telegram Post
• https://t.me/cveNotify/161584 · Telegram Post