CVE-2026-114230 Details
Description
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet. This issue affects Apache Qpid Proton C: through 0.40.0. Users are recommended to upgrade to version 0.41.1, which fixes the issue.
An authentication bypass vulnerability has been identified in Apache Qpid Proton C versions prior to 0.40.0. When SASL frames are dispatched for authentication, the library also inadvertently sends AMQP frames that claim to be SASL frames. This misrouting allows for authentication bypass. Although no username is assigned in this scenario, the impact varies depending on how the application handles this condition, which typically indicates that authentication has not yet been completed.
Users are advised to upgrade to Apache Qpid Proton C version 0.41.1, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 29, 2026CISA-ADP
Assessed Nov 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/10/28/24 | CVE | AdvisoryMailing ListRemedy |
| https://lists.apache.org/thread.html/ob7vo6swpj4wbb2m3zq9q2vkwfg5dg8k | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-305 | Authentication Bypass by Primary Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Qpid Proton | <= 0.40.0 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 5, 2026 | CVE Modified | CISA-ADP |
| Oct 29, 2026 | CVE Modified | CVE |
| Oct 29, 2026 | New CVE Received | [email protected] |