Loading vulnerability…
Missing TLS Hostname Verification in Spring Boot Cassandra Auto-configuration
CVE-2026-40974 is a TLS server identity verification vulnerability in Spring Boot's Cassandra SSL auto-configuration. Connections established through the affected auto-configuration do not verify that the server certificate matches the intended Cassandra hostname, potentially allowing endpoint impersonation and man-in-the-middle attacks. Affected versions include 4.0.0–4.0.5, 3.5.0–3.5.13, 3.4.0–3.4.15, 3.3.0–3.3.18, and 2.7.0–2.7.32. Unsupported versions are also affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker able to intercept or redirect application-to-Cassandra connections could impersonate the database endpoint using a certificate that passes the remaining TLS trust checks but does not match the intended hostname. Successful exploitation could expose database credentials and application data transmitted over the connection and permit manipulation of database requests or responses. The flaw does not, by itself, establish that certificate-chain validation is disabled.
If you can’t patch tonight, do this now.
No vendor-provided temporary workaround is identified. Where feasible, replace or override the affected Cassandra SSL auto-configuration with custom TLS configuration that explicitly enforces hostname verification. Restrict application-to-Cassandra network paths to reduce opportunities for interception; network restrictions are not a substitute for hostname verification.
Patch, then assume compromise.
Upgrade Spring Boot to 4.0.6, 3.5.14, 3.4.16, 3.3.19, or 2.7.33, as appropriate for the deployed release line, or a later fixed release. Deployments using unsupported versions should migrate to a supported fixed release.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.