Hostname Verification Flaw in Spring Boot’s Elasticsearch Auto-Configuration

CVE-2026-40970

What is CVE-2026-40970?

This vulnerability in Spring Boot’s Elasticsearch auto-configuration stems from the improper handling of hostname verification when utilizing an SSL bundle for connections to Elasticsearch servers. Without adequate validation of the server's hostname, there is a potential for man-in-the-middle attacks, which could compromise the integrity and confidentiality of sensitive data transmitted between applications.

References