CVE-2026-33467 MEDIUM

CVE-2026-33467: Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass

Vendor Elastic
Product Elastic Package Registry
Weakness CWE-347
Published April 28, 2026
Last update April 29, 2026
View on NVD All CVEs

CVSS base score

5.9/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality None
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

What the vulnerability does

01Description

Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed.

Key dates

02Disclosure timeline

April 28, 2026 CVE published
April 29, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-44309 gitsign verify accepts signatures over go-git-normalized bytes, enabling trust confusion on malformed commits CVE-2026-45575 epa4all-client: Improper Verification of Cryptographic Signature CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel CVE-2026-11800 Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion CVE-2026-41301 OpenClaw 2026.3.22 < 2026.3.31 - Forged Nostr DM Pairing State Creation via Signature Verification Bypass