CVE-2026-40974 is a vulnerability in Spring Boot's Cassandra SSL auto-configuration where hostname verification is not performed during SSL connection establishment. This improper certificate validation (CWE-295) can allow attackers to intercept or manipulate communications by exploiting the lack of hostname checks. The issue affects Spring Boot versions 2.7.0 to 2.7.32, 3.3.0 to 3.3.18, 3.4.0 to 3.4.15, 3.5.0 to 3.5.13, and 4.0.0 to 4.0.5. Vendor advisories indicate fixes are available in versions 2.7.33, 3.3.19, 3.4.16, 3.5.14, and 4.0.6 respectively. No known exploits are reported in the wild.

The vulnerability allows an attacker with network access to potentially perform man-in-the-middle attacks against SSL connections to Cassandra by exploiting the lack of hostname verification. This can lead to partial confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L). However, exploitation requires high attack complexity and is limited to adjacent network attackers.

Fixes are available in Spring Boot versions 2.7.33, 3.3.19, 3.4.16, 3.5.14, and 4.0.6. Users should upgrade affected Spring Boot versions to these patched releases to remediate the vulnerability. Since this is not a cloud service, remediation depends on user action. Patch status is confirmed by vendor advisories specifying fixed versions. No other mitigation steps are indicated.