What is the CVSS score of CVE-2026-40970?

CVE-2026-40970 has a CVSS 3.1 base score of 5.0 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-40970?

Yes, a patch is available for CVE-2026-40970. Update the affected software to the latest version immediately.

Spring Boot CVE-2026-40970

EUVD-2026-25908 MEDIUM

Improper Certificate Validation (CWE-295)

2026-04-27 security@vmware.com

Java Information Disclosure VMware Elastic Spring Boot

5.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

vuln.today AI

5.0 MEDIUM

Adjacent-network MITM requires both physical/logical proximity and an SSL bundle configuration, justifying AV:A and AC:H; no application-layer privileges needed, and impact per dimension is low.

3.1 AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:A/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Red Hat

4.2 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 05:03 vuln.today

Patch available

Apr 27, 2026 - 21:01 EUVD

Patch released

Apr 27, 2026 - 19:26 nvd

Patch available

EUVD ID Assigned

Apr 27, 2026 - 19:22 euvd

EUVD-2026-25908

CVE Published

Apr 27, 2026 - 19:16 nvd

MEDIUM 5.0

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

17 maven packages depend on org.springframework.boot:spring-boot-elasticsearch (4 direct, 13 indirect)

Ecosystem-wide dependent count for version 4.0.0.

DescriptionCVE.org

When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.

Affected: Spring Boot 4.0.0-4.0.5; upgrade to 4.0.6 or later per vendor advisory.

AnalysisAI

Spring Boot's Elasticsearch auto-configuration omits hostname verification when an SSL bundle is used, opening TLS connections to the Elasticsearch server to man-in-the-middle interception by an attacker on the adjacent network. Affected versions are 4.0.0 through 4.0.5; only deployments explicitly configured with an SSL bundle are exposed. No active exploitation is confirmed (absent from CISA KEV, EPSS 0.01% at the 3rd percentile), and VMware has released a fix in version 4.0.6.

Technical ContextAI

CWE-295 (Improper Certificate Validation) identifies the root cause: the auto-configured Elasticsearch REST client accepts TLS certificates without checking that the server's CN or SAN matches the intended hostname, making the TLS handshake trivially spoofable. Spring Boot's SSL bundle abstraction, introduced as a convenience mechanism for supplying keystores and truststores declaratively, is the specific feature path that triggers the flaw. Without an SSL bundle configured the auto-configuration code path is not reached and the vulnerability is not present. The affected component is identified by CPE cpe:2.3:a:vmware:spring_boot:*:*:*:*:*:*:*:* and confirmed by ENISA EUVD-2026-25908 as covering Spring Boot 4.0.0 through 4.0.5.

RemediationAI

Upgrade to Spring Boot 4.0.6 or later, which corrects hostname verification in the Elasticsearch auto-configuration. The vendor-released patch is documented at https://spring.io/security/cve-2026-40970. If an immediate upgrade is not possible, define a custom Elasticsearch REST client bean explicitly enabling HTTPS hostname verification (HostnameVerifier set to HTTPS_STRICT), which bypasses the faulty auto-configuration path entirely; this requires application code changes and connectivity re-testing. As a network-level compensating control, isolate Elasticsearch traffic to a dedicated private VLAN or segment where adjacent-network MITM is infeasible, reducing practical risk while the upgrade is scheduled. Disabling SSL entirely is not an acceptable workaround as it eliminates transport encryption.