Spring Boot CVE-2026-40974

Exploitation requires four specific conditions: (1) Spring Boot application with Cassandra auto-configuration explicitly enabled (org.springframework.boot:spring-boot-starter-data-cassandra or manual @EnableCassandraRepositories), (2) Cassandra cluster configured to require or prefer SSL/TLS connections, (3) network positioning on the same local/adjacent network segment as the application and Cassandra server (AV:A - not internet-routable), and (4) ability to present a valid SSL certificate signed by a certificate authority trusted by the application (e.g., a public CA or internal PKI). The vulnerability does NOT require authentication to the Cassandra cluster itself (PR:N) or user interaction (UI:N) - once the attacker intercepts the connection with a valid certificate, the auto-configuration automatically accepts it. Deployments using hostname verification in custom Cassandra configurations, or applications not using Cassandra auto-configuration, are NOT affected. Additionally, environments with mutual TLS (mTLS) requiring client certificate authentication, or those using pinning (certificate pinning) in the application, may provide additional protection but do not fully mitigate this vulnerability if hostname verification is absent.

CVSS vector AV:A/AC:H/PR:N/UI:N indicates local/adjacent network access with high attack complexity, suggesting a real-world threat only in specific network topologies. The CVSS base score of 5.0 (medium) reflects the combination of moderate impact (confidentiality and integrity breaches for Cassandra credentials and queries) but limited attack surface (adjacent network only, not internet-routable). The AV:A designation is the primary constraint-this is not remotely exploitable from the internet, reducing widespread risk. However, in internal network environments where Spring Boot applications connect to Cassandra over TLS, this is a practical man-in-the-middle vulnerability: an attacker on the LAN segment can intercept database credentials and sensitive data without user interaction (UI:N). The AC:H (high attack complexity) likely reflects the need to position oneself on the network path and obtain or generate a valid certificate (though a valid CA-signed cert for any domain suffices if no hostname verification occurs). The confidentiality and integrity impacts (C:L/I:L) are accurately scoped-attackers gain access to database traffic but not necessarily full system compromise. No EPSS score provided, but exploitation requires both network proximity AND a valid certificate, making this a targeted rather than mass-exploitation risk. Real-world severity depends heavily on deployment: internal corporate networks with Cassandra clusters are at higher risk than internet-facing SaaS deployments.

An attacker on a corporate network segment hosting both a Spring Boot application and its Cassandra database obtains or generates a valid SSL certificate (e.g., via a compromised internal CA or by leveraging a domain registrar). The attacker then performs ARP spoofing or DNS poisoning to intercept traffic between the Spring Boot application and the Cassandra server. When the application reconnects with the patched certificate, Spring Boot's Cassandra auto-configuration accepts the certificate (it is valid and signed by a trusted CA) but does not verify the hostname, completing the TLS handshake. The attacker decrypts and logs all Cassandra credentials and queries, exfiltrating sensitive data or injecting malicious commands into the database session.