Elastic Package Registry version 0.1.0 contains a vulnerability classified as CWE-347, where cryptographic signatures are not properly verified. This improper verification could enable an attacker positioned to intercept network traffic or manipulate the contents served by a self-hosted registry to replace a legitimate package with a tampered one without detection. The CVSS 3.1 base score is 5.9 (medium), reflecting network attack vector with high attack complexity and no privileges or user interaction required. The vulnerability impacts package integrity but does not affect confidentiality or availability.

An attacker capable of intercepting or influencing network traffic to a self-hosted Elastic Package Registry could substitute malicious packages without detection due to improper signature verification. This undermines the integrity of packages delivered to users, potentially leading to the deployment of compromised software. There is no impact on confidentiality or availability according to the CVSS vector. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting network access to the self-hosted registry to trusted parties only and employ additional transport security measures such as VPNs or secure tunnels to reduce the risk of interception or tampering.