CVE-2026-40970

A flaw was found in Spring Boot. When configured to use an SSL (Secure Sockets Layer) bundle, the Elasticsearch auto-configuration component does not perform hostname verification when establishing a connection to the Elasticsearch server. An attacker on an adjacent network could exploit this by performing a man-in-the-middle attack. This could lead to the disclosure or modification of sensitive information exchanged between Spring Boot and the Elasticsearch server.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate the risk of man-in-the-middle attacks, ensure that network communication between Spring Boot applications and Elasticsearch servers is protected. This can be achieved by deploying these components on a trusted, isolated network segment or by implementing strict firewall rules to limit access to the Elasticsearch server only from authorized Spring Boot application instances.