EUVD-2026-26140Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Network attack vector with AC:H for required MITM position; PR:N as no credentials needed; I:H for unchecked package substitution; C:N and A:N as no data disclosure or service disruption results.
Primary rating from Vendor (elastic).
CVSS VectorVendor: elastic
Lifecycle Timeline
3DescriptionCVE.org
Improper Verification of Cryptographic Signature (CWE-347) in Elastic Package Registry could allow an attacker positioned to intercept network traffic, or to otherwise influence the contents served to a self-hosted registry, to substitute a tampered package without the integrity check failing closed.
AnalysisAI
Cryptographic signature verification bypass in Elastic Package Registry versions 0.1.0 through 1.37.0 allows an adversary-in-the-middle, or an attacker with influence over a self-hosted registry's served content, to substitute tampered packages that are accepted without triggering integrity check failures. The flaw (CWE-347) undermines supply-chain integrity for organizations running self-hosted registry instances. No active exploitation is confirmed (SSVC: exploitation none; EPSS 0.02%), but the high integrity impact and zero-privilege-required vector make patching to 1.38.0 a priority for self-hosted deployments.
Technical ContextAI
Elastic Package Registry is the distribution layer for Elastic Stack integration packages - it serves packages consumed by Kibana and related tooling, making it a supply-chain trust anchor. CWE-347 (Improper Verification of Cryptographic Signature) indicates the registry's package integrity check fails open rather than closed: when a tampered package is presented, the signature validation does not correctly reject it. The tags reference 'Jwt Attack', suggesting the signature mechanism may be JWT-based or token-based, which is consistent with improper verification of a signed assertion rather than a traditional asymmetric code-signing scheme. The full CPE cpe:2.3:a:elastic:elastic_package_registry:*:*:*:*:*:*:*:* spans all versions up to 1.37.0, with EUVD-2026-26140 bounding the range explicitly at 0.1.0-1.37.0.
RemediationAI
Upgrade Elastic Package Registry to version 1.38.0, which resolves the signature verification flaw per the vendor advisory at https://discuss.elastic.co/t/elastic-package-registry-1-38-0-security-update-esa-2026-27/386081. Note: the fix version 1.38.0 is inferred from the advisory thread title and should be confirmed against the official release notes prior to deployment. For organizations unable to upgrade immediately, restrict network access to the self-hosted registry to explicitly trusted client hosts using firewall rules or network segmentation, reducing MITM exposure - this adds operational overhead and does not address the root cause. Additionally, enforcing mutual TLS between registry clients and the server can reduce the feasibility of traffic interception, though this requires client-side certificate management. Neither compensating control remediates the underlying signature verification flaw.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Moderate| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today