Spring Boot auto‑configures Cassandra connections over SSL but does not validate the server’s hostname in the certificate presented. This is a CWE‑295 vulnerability. It could allow an attacker to intercept or tamper with encrypted traffic if the attacker can present a forged or re‑signed certificate. The impact is potential compromise of confidentiality and integrity of the data exchanged with the Cassandra cluster.

The affected products are Spring Boot 4.0.0 through 4.0.5, 3.5.0 through 3.5.13, 3.4.0 through 3.4.15, 3.3.0 through 3.3.18, and 2.7.0 through 2.7.32, all of which perform Cassandra SSL auto‑configuration. Fixed releases begin at 4.0.6, 3.5.14, 3.4.16, 3.3.19, and 2.7.33 respectively. Unsupported releases that still use Cassandra SSL auto‑configuration are also vulnerable.

The CVSS score of 5 indicates moderate severity. Based on the description, it is inferred that the vulnerability can be exploited by an attacker who has network access between the Spring Boot application and the Cassandra cluster or who can impersonate the Cassandra server with a fabricated certificate. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation is currently unknown. Nonetheless, the potential for internal threat actors or compromised nodes to undermine data confidentiality and integrity warrants timely mitigation.