Back spring.io

CVE-2026-40970: Elasticsearch auto-configuration with an SSL bundle disables TLS hostname verification

spring.io • April 27, 2026

When configured to use an SSL bundle, Spring Boot's Elasticsearch auto-configuration does not perform hostname verification when connecting to the Elasticsearch server.

Users of affected versions should upgrade to the corresponding fixed version.

No further mitigation steps are necessary.

The issue was identified and responsibly reported by Yu Bao (@August829) - [email protected] – who works for paypal.com.

To report a security vulnerability for a project within the Spring portfolio, see the Security Policy

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Check out all the upcoming events in the Spring community.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Vulnerabilities in Spring Boot's SSL Configuration for Elasticsearch and RabbitMQ Two critical vulnerabilities have been identified in Spring Boot's auto-configuration for Elasticsearch and RabbitMQ. CVE-2026-40970 affects Elasticsearch, while CVE-2026-40971 impacts RabbitMQ. Both vulnerabilities occur when configured to use an SSL bundle, leading to the disabling of TLS hostname verification during connections to their respective servers. Users of affected versions are advised to upgrade to fixed versions immediately. The vulnerabilities were reported by Yu Bao from PayPal. No further mitigation steps are necessary beyond upgrading. The issues could potentially expose users to man-in-the-middle attacks if exploited. The vulnerabilities were disclosed on April 27, 2026. 2 sources 71

Extracted Entities

CVE-2026-40970: Elasticsearch auto-configuration with an SSL bundle disables TLS hostname verification

The full story

Extracted Entities

CVEs (1)

Domains (1)

Platforms (4)