CVE-2026-33467: fallo de gravedad media en Elastic Package Registry
Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass
Publicada el · Actualizada el
Seguir esta CVE+ Monitorear Elastic Package Registry+ Monitorear github.com/elastic/package-registry
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.9epss 0.1%
Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Productos afectados
Elastic · Elastic Package Registry