CVE-2026-40970 — When configured to use an SSL bundle, Spring Boot's

title: Spring Boot Elasticsearch SSL Bundle Hostname Verification Bypass - CVE-2026-40970
id: scw-2026-04-27-ai-1
status: experimental
level: medium
description: |
  This rule detects potential exploitation of CVE-2026-40970 by identifying web server requests to Elasticsearch on port 9200, specifically targeting the '_cluster/health' endpoint. This bypasses hostname verification when Spring Boot is configured with an SSL bundle, allowing an attacker to potentially interact with an Elasticsearch cluster without proper authentication or validation.
author: SCW Feed Engine (AI-generated)
date: 2026-04-27
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-40970/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/_cluster/health'
      cs-method:
          - 'GET'
      sc-status:
          - '200'
      dst_domain:
          - 'elasticsearch.local'
      dst_port:
          - '9200'
  condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse