PT-2026-35818 · Elastic · Package Registry

Ismisepaul + 1 · CVE-2026-33467 · Published 2026-04-28 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Elastic Package Registry (affected versions not specified)

Description Improper Verification of Cryptographic Signature occurs in the Elastic Package Registry. This issue allows an attacker who can intercept network traffic or influence the content served to a self-hosted registry to substitute a tampered package without the integrity check failing closed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2026-33467

GHSA-R727-5PF6-47R2

GO-2026-5611

OPENSUSE-SU-2026:21483-1

Affected Products

Package Registry

References · 1745

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33467.json · Exploit
• https://osv.dev/vulnerability/GO-2026-5611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33467 · Security Note
• https://osv.dev/vulnerability/GHSA-r727-5pf6-47r2 · Vendor Advisory
• https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33467 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/elastic/package-registry · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note
• https://suse.com/security/cve/CVE-2026-25232 · Note
• https://suse.com/security/cve/CVE-2026-55513 · Note