Improper Cryptographic Signature Verification in Elastic Package Registry by Elastic

CVE-2026-33467

What is CVE-2026-33467?

An improper verification of cryptographic signature vulnerability within the Elastic Package Registry can expose systems to significant risks. This issue allows malicious entities with the ability to intercept network traffic or otherwise manipulate the data served to a self-hosted registry to inject altered packages. The lack of a robust integrity check means that tampering could go undetected, potentially leading to compromised software packages being deployed in production environments.

References