The vulnerability CVE-2026-33467 affects Elastic Package Registry version 0.1.0 and is categorized under CWE-347 (Improper Verification of Cryptographic Signature). It allows an attacker positioned to intercept network traffic or influence the self-hosted registry contents to replace a package with a tampered one without the integrity verification failing. This undermines the trustworthiness of package distribution by the registry. The CVSS v3.1 base score is 5.9 (medium severity), with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation guidance is currently available from Elastic.

An attacker able to intercept or manipulate network traffic to a self-hosted Elastic Package Registry could substitute malicious or tampered packages without detection due to improper cryptographic signature verification. This compromises the integrity of packages delivered to users relying on the registry, potentially leading to the installation of unauthorized or malicious code. There is no impact on confidentiality or availability reported. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by Elastic, users of Elastic Package Registry version 0.1.0 should exercise caution when using self-hosted registries and consider additional integrity verification measures outside the vulnerable mechanism until a patch or official mitigation is released.