Go/github.com/elastic/package-registry CVE-2026-33467: medium 5.9, EPSS 0.14%
Elastic Package Registry has Improper Verification of Cryptographic Signature
Action: Upgrade github.com/elastic/package-registry to 1.38.0 or later.
go get github.com/elastic/package-registry@v1.38.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.38.0 | - |
Fixed versions
| 1.38.0 |
Sources
- osv: GHSA-r727-5pf6-47r2
- https://nvd.nist.gov/vuln/detail/CVE-2026-33467
- https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081
- https://github.com/elastic/package-registry
CVE-2026-33467 · published · modified · JSON