This vulnerability arises from an improper verification of cryptographic signatures (CWE‑347) in Elastic Package Registry, allowing an attacker positioned to intercept network traffic or influence the contents served to a self‑hosted registry to substitute a tampered package silently. The integrity check would not detect the substitute, potentially enabling the attacker to deliver malicious code to consumers that rely on the registry. This flaw could lead to unauthorized code execution on systems that pull and execute packages without additional validation.

The affected product is Elastic Package Registry from Elastic. No specific version information is provided in the available data, so any installation of Elastic Package Registry that predates the referenced security update may be vulnerable.

The CVSS score is 5.9, indicating a moderate potential impact. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is an attacker with the ability to intercept traffic or otherwise manipulate the registry contents; once a tampered package is deployed, the attacker could execute arbitrary code on downstream hosts. No confirmed exploits are currently known, but the impact warrants timely remediation.