Is CVE-2026-40970 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40970 being exploited in the wild.

How severe is CVE-2026-40970?

Medium severity, with a CVSS score of 5, published 27 April 2026.

Which products and versions are affected?

org.springframework.boot:spring-boot-elasticsearch (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.6; VMware Spring Boot 4.0.0 to 4.0.5.

Is there a fix for CVE-2026-40970?

Yes. org.springframework.boot:spring-boot-elasticsearch (Maven): upgrade to 4.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-40970 attacked?

It is attacked from the adjacent network, in a software library.

Am I affected by CVE-2026-40970?

Check whether you run org.springframework.boot:spring-boot-elasticsearch (Maven) or VMware Spring Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40970: VMware Spring Boot improper certificate validation in Elasticsearch auto-configuration

CVE-2026-40970 · Severity: medium · CVSS 5 · Published 2026-04-27

Spring Boot is a popular framework used to build Java-based web applications. A security issue exists where applications connecting to Elasticsearch databases may fail to verify the identity of the server they are talking to. This could allow an attacker on the same network to intercept or modify sensitive data by impersonating the database server.

Technologies: VMware Spring Boot. Vendors: Maven, VMware.

Quick answers

Is CVE-2026-40970 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40970 being exploited in the wild.
How severe is CVE-2026-40970?: Medium severity, with a CVSS score of 5, published 27 April 2026.
Which products and versions are affected?: org.springframework.boot:spring-boot-elasticsearch (Maven) ECOSYSTEM:introduced=4.0.0,fixed=4.0.6; VMware Spring Boot 4.0.0 to 4.0.5.
Is there a fix for CVE-2026-40970?: Yes. org.springframework.boot:spring-boot-elasticsearch (Maven): upgrade to 4.0.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40970 attacked?: It is attacked from the adjacent network, in a software library.
Am I affected by CVE-2026-40970?: Check whether you run org.springframework.boot:spring-boot-elasticsearch (Maven) or VMware Spring Boot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.springframework.boot:spring-boot-elasticsearch (Maven): upgrade to 4.0.6 or later

# set org.springframework.boot:spring-boot-elasticsearch to 4.0.6 in your pom.xml or build.gradle

Technical details

A CWE-295 (Improper Certificate Validation) vulnerability exists in Spring Boot's Elasticsearch auto-configuration component. When the application is configured to use SSL bundles for secure communication, it fails to perform hostname verification during the TLS handshake with the Elasticsearch server. An attacker with adjacent network access could perform a man-in-the-middle (MitM) attack to intercept or spoof communications between the application and the database. This issue affects Spring Boot versions 4.0.0 through 4.0.5 and is resolved in version 4.0.6.

Affected products

VMware Spring Boot 4.0.0 to 4.0.5

Identifiers

CVE-2026-40970
GHSA-c96x-rpm4-349p

Timeline

2026-04-27: disclosed
2026-04-27: advisory: VMware published vendor advisory
2026-05-14: other: NVD initial analysis completed

References

https://spring.io/security/cve-2026-40970

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.