Executive brief
The Elastic Package Registry is a service used to distribute and manage software packages within the Elastic ecosystem. A security flaw in self-hosted versions of this registry could allow an attacker who can intercept network traffic to replace legitimate software packages with tampered versions. If exploited, this could lead to the installation of malicious or unauthorized software on systems that rely on the registry for updates.
Technical details
An Improper Verification of Cryptographic Signature (CWE-347) vulnerability exists in Elastic Package Registry versions up to and including 1.37.0. The flaw occurs in self-hosted deployments that synchronize packages from an upstream source via proxy mode or distribution tools. An attacker positioned to intercept or modify network traffic (Man-in-the-Middle) can substitute a tampered package because the registry fails to 'fail closed' when an integrity check fails. This allows the registry to accept and serve malicious packages as if they were authentic. The issue is resolved in version 1.38.0.
Affected products
- Elastic Elastic Package Registry 0.1.0 to 1.37.0
Timeline
- 2026-04-28: disclosed
- 2026-04-28: advisory
- 2026-04-28: patched