CVE-2026-33467 Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass
Attackers can bypass integrity checks to install tampered packages in Elastic Package Registry, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33467?
CVE-2026-33467 is a medium-severity vulnerability in Elastic Package Registry, published on 28 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed.
Weakness: CWE-347
Which versions are affected by CVE-2026-33467?
3 open source packages ship an affected version, including github.com/elastic/package-registry. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/elastic/package-registry Go | All versions | 1.38.0 |
github.com/elastic/package-registry Go | All versions | 1.38.0 |
github.com/elastic/package-registry Go | All versions | 1.38.0 |
Products include Elastic Elastic Package Registry.
How do I fix CVE-2026-33467?
Upgrade github.com/elastic/package-registry to 1.38.0 or later.
Is CVE-2026-33467 being exploited?
There is no known exploitation of CVE-2026-33467 in the wild and no public exploit code.
Sources
Also known as GHSA-r727-5pf6-47r2, GO-2026-5611.