CVE-2026-40974: 
Java vulnerability analysis and mitigation

CVE-2026-40974 is a TLS hostname verification bypass vulnerability in Spring Boot's Cassandra SSL auto-configuration, allowing network-adjacent attackers to perform man-in-the-middle (MitM) attacks against Cassandra database connections. Disclosed on April 23, 2026, it affects Spring Boot versions 2.7.0–2.7.32, 3.3.0–3.3.18, 3.4.0–3.4.15, 3.5.0–3.5.13, and 4.0.0–4.0.5; unsupported versions are also affected per the vendor advisory. The GitHub Advisory Database rates this as Moderate with a CVSS v3.1 score of 5.0 (AV:A/AC:H), while Feedly's aggregated data reflects a higher score of 9.8 based on an alternate vector assessment (Spring Advisory, GitHub Advisory).

The root cause is classified as CWE-295 (Improper Certificate Validation): Spring Boot's Cassandra auto-configuration omits hostname verification during SSL/TLS handshake establishment, meaning the client does not confirm that the server's certificate matches the expected hostname. This enables a network-adjacent attacker positioned between the Spring Boot application and the Cassandra cluster to present a fraudulent certificate and intercept or tamper with the encrypted connection. Exploitation requires the attacker to be on the same network segment (adjacent network) and to have the ability to intercept traffic (e.g., ARP spoofing or rogue DNS), making the attack complexity high. The affected Maven artifact is org.springframework.boot:spring-boot-cassandra (Spring Advisory, GitHub Advisory).

A successful exploit allows an unauthenticated, network-adjacent attacker to decrypt and read sensitive database traffic in transit, modify data being sent to or from Cassandra, or impersonate the Cassandra server entirely. This exposes confidentiality, integrity, and availability of all data exchanged over the SSL-protected Cassandra connection, potentially including credentials, application data, and query results. Downstream IBM products using Spring Boot — including IBM API Connect, IBM Instana Observability, IBM Sterling Connect:Direct Web Services, and IBM Business Automation Manager Open Editions — are also affected (Spring Advisory, IBM Advisory).

1. Reconnaissance: Identify Spring Boot applications using Cassandra with SSL enabled (e.g., via service discovery, configuration file exposure, or network scanning for Cassandra's default port 9042/9142).
2. Network Positioning: Gain a man-in-the-middle position on the network segment between the Spring Boot application and the Cassandra cluster using techniques such as ARP spoofing, rogue DHCP, or DNS poisoning.
3. Certificate Spoofing: Present a self-signed or attacker-controlled TLS certificate for the Cassandra endpoint. Because the vulnerable Spring Boot auto-configuration skips hostname verification, the client will accept this certificate without validating that it matches the expected Cassandra hostname.
4. Traffic Interception/Manipulation: Decrypt and inspect the Cassandra native protocol traffic (CQL queries, responses, credentials) or inject malicious data/commands into the database stream.
5. Data Exfiltration or Tampering: Extract sensitive application data from intercepted queries, harvest credentials, or modify query results returned to the application (Spring Advisory, GitHub Advisory).

• Network: Unexpected ARP table changes or duplicate MAC addresses on the network segment hosting Cassandra; unusual TLS certificate presented on Cassandra ports (9042/9142) that does not match the expected CA or hostname; anomalous traffic flows between the application server and Cassandra from unexpected intermediate hosts.
• Logs: TLS handshake errors or certificate warnings in application logs if partial hostname verification is attempted; unexpected Cassandra connection sources in Cassandra audit logs; SSL session establishment from IP addresses not belonging to known application servers.
• Process/Configuration: Spring Boot application configured with spring.cassandra.ssl.enabled=true but running a vulnerable version (below the fixed releases); absence of hostname verification configuration in Cassandra driver settings.

Users should upgrade to the corresponding fixed Spring Boot version immediately: 4.0.6 (OSS), 3.5.14 (OSS), 3.4.16 (Enterprise Support), 3.3.19 (Enterprise Support), or 2.7.33 (Enterprise Support). No additional configuration-based workarounds are required beyond upgrading. As a temporary defense-in-depth measure, implement network segmentation to restrict access to Cassandra ports (9042/9142) to only trusted application hosts, and consider using a VPN or encrypted overlay network for database traffic if patching is delayed. IBM product users should apply the corresponding IBM-specific patches for API Connect, Instana, Sterling Connect:Direct Web Services, and Business Automation Manager Open Editions (Spring Advisory, IBM Advisory).

The Spring team (Broadcom/VMware) published the initial security advisory on April 23, 2026, rating the vulnerability as MEDIUM severity and providing fixed versions across all supported branches (Spring Advisory). HeroDevs published a blog post covering this and other Spring Boot April 2026 CVEs, noting the broader context of eight CVEs disclosed in that release cycle (HeroDevs Blog). IBM issued multiple security bulletins for affected downstream products, reflecting the wide reach of Spring Boot in enterprise software stacks (IBM Advisory).