CVE-2026-33467
CVE-2026-33467 is a medium-severity vulnerability in Elastic Elastic Package Registry with a CVSS 3.x base score of 5.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-347.
Key facts
- Severity: Medium (CVSS 3.x base score 5.9)
- EPSS exploit prediction: 0% (3rd percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2026-26140
- Weakness: CWE-347
- Affected product: Elastic Elastic Package Registry
- Published:
- Last modified:
Description
Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed.
Frequently asked questions
- What is CVE-2026-33467?
- Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed.
- How severe is CVE-2026-33467?
- CVE-2026-33467 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
- Is CVE-2026-33467 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (3rd percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2026-33467?
- CVE-2026-33467 affects Elastic Elastic Package Registry. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2026-33467?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2026-33467 have an EU (EUVD) identifier?
- Yes. CVE-2026-33467 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-26140.
- When was CVE-2026-33467 published?
- CVE-2026-33467 was published on 2026-04-28 and last updated on 2026-07-24.
References
Affected products (1)
- cpe:2.3:a:elastic:elastic_package_registry:*:*:*:*:*:*:*:*
Other CWE-347 (Improper Verification of Cryptographic Signature) vulnerabilities
- CVE-2026-5430 — Critical (CVSS 10.0): The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or…
- CVE-2026-56451 — Critical (CVSS 10.0): A vulnerability has been identified in Opcenter X (All versions < V2604). Affected applications do not properly…
- CVE-2026-48558 — Critical (CVSS 10.0): SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the…
- CVE-2023-25574 — Critical (CVSS 10.0): `jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI).…
- CVE-2024-45409 — Critical (CVSS 10.0): The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <=…
- CVE-2024-32962 — Critical (CVSS 10.0): xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default…
Browse all CWE-347 (Improper Verification of Cryptographic Signature) vulnerabilities →