# Elastic Package Registry 1.38.0 Security Update (ESA-2026-27) **URL:** \ **Category:** Security Announcements\ **Created:** [April 28, 2026, 9:11pm UTC](https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081 "2026-04-28T21:11:09Z")\ **Posts on this page:** 1\ **Showing post:** 1
**Author:** ![ismisepaul](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismisepaul/32/102235_2.png) [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Post date:** [April 28, 2026, 9:11pm UTC](https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081/1 "2026-04-28T21:11:09Z")
**Improper Verification of Cryptographic Signature in Elastic Package Registry Leading to Package Integrity Bypass** Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed. **Affected Versions:** - All versions of the Elastic Package Registry up to and including 1.37.0. **Affected Configurations:** - Self-hosted deployments that sync packages from an upstream source (via the distribution tool or proxy mode). Exploitation requires an attacker positioned to intercept or modify network traffic between the self-hosted Elastic Package Registry and its upstream source. **Not affected Configurations:** - Elastic's public package registry at `https://epr.elastic.co` and deployments that pull packages directly from it. **Solutions and Mitigations:** The issue is resolved in Elastic Package Registry version 1.38.0. **Severity:** CVSSv3.1: Medium ( 5.9 ) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N **CVE ID:** CVE-2026-33467 **Problem Type:** CWE-347 - Improper Verification of Cryptographic Signature --- _[View the full topic](https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081)._