{"id":"CVE-2026-105031","kind":"vulnerability","aliases":["CVE-2026-105031"],"related":[],"title":"Apache Qpid Proton C: OpenSSL builds trust system CAs, accepting unexpected peer certificates","description":"When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.","summary":"When the OpenSSL TLS backend is used, the trusted CA APIs added certificates to the system trust anchors instead of replacing them. An attacker holding a certificate signed by any system-trusted authority may be accepted as a TLS peer.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amqp","messaging","openssl","package","qpid-proton"],"not_affected_if":["no-custom-trust-anchors","schannel-tls"],"how_to_check":"- Check whether the application links Apache Qpid Proton C with the OpenSSL TLS implementation (not Win32 SChannel).\n- Check the installed Proton version against the affected range, `0.40.0` and earlier.\n- Check whether the application calls `pn_ssl_domain_set_trusted_ca_db()` or `pn_tls_config_set_trusted_certs()`.","fix":"- Apache Qpid Proton C: upgrade to `0.41.1`.\n- Workaround stated in the sources: set the `SSL_CERT_FILE` environment variable for the application to `/dev/null`.","status":"open","published_at":"2026-10-29T11:17:24+00:00","first_seen_at":"2026-10-29T11:24:27+00:00","triaged_at":"2026-10-29T11:25:43+00:00","updated_at":"2026-10-29T11:25:43+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-29T11:25:43Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Qpid Proton C: upgrade to `0.41.1`.\n- Workaround stated in the sources: set the `SSL_CERT_FILE` environment variable for the application to `/dev/null`.","reach":"network","title":"Apache Qpid Proton C: OpenSSL builds trust system CAs, accepting unexpected peer certificates","impact":"medium","summary":"When the OpenSSL TLS backend is used, the trusted CA APIs added certificates to the system trust anchors instead of replacing them. An attacker holding a certificate signed by any system-trusted authority may be accepted as a TLS peer.","audience":"developers","category":"package","nicknames":[],"who_cares":["qpid-proton","openssl","amqp","messaging"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker with a system-trusted certificate impersonates a TLS peer","analyst_note":"","how_to_check":"- Check whether the application links Apache Qpid Proton C with the OpenSSL TLS implementation (not Win32 SChannel).\n- Check the installed Proton version against the affected range, `0.40.0` and earlier.\n- Check whether the application calls `pn_ssl_domain_set_trusted_ca_db()` or `pn_tls_config_set_trusted_certs()`.","plain_action":"","needs_analyst":false,"not_affected_if":["schannel-tls","no-custom-trust-anchors"],"who_is_affected":"Applications built on Apache Qpid Proton C with the OpenSSL TLS backend that rely on the custom trusted CA APIs to restrict which peer certificates are accepted. Windows builds using SChannel are not affected, per the sources. Teams that do not call the trusted CA setters or do not use OpenSSL TLS can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000759,"input_tokens":4233,"output_tokens":671,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105031':16A,19A '-2026':15A,18A '/dev/null':124C '0.40.0':143C '0.41.1':151C 'accept':10A,63B 'add':38B,90C 'affect':129C,137C 'amqp':20B 'anchor':44B,99C 'apach':1A,138C 'api':37B,89C 'applic':122C 'around':111C 'attack':50B 'author':60B 'backend':31B 'build':6A 'c':4A,141C 'ca':36B,81C 'cas':9A 'cert':88C,116C 'certif':13A,39B,53B,106C 'config':85C 'cve':14A,17A 'db':82C 'default':96C 'domain':78C 'environ':118C 'file':117C 'fix':153C 'hold':51B 'implement':73C,134C 'instead':45B 'issu':126C,136C,155C 'lead':100C 'may':61B 'messag':21B 'openssl':5A,22B,29B,71C 'packag':23B 'peer':12A,67B,105C 'pn':76C,83C 'potenti':102C 'proton':3A,26B,140C 'qpid':2A,25B,139C 'qpid-proton':24B 'rather':92C 'recommend':146C 'replac':47B,94C 'schannel':132C 'set':79C,86C,113C 'sign':54B 'ssl':77C,115C 'system':8A,42B,58B,97C 'system-trust':57B 'tls':30B,66B,72C,84C,133C 'trust':7A,35B,43B,59B,80C,87C,98C,103C 'unexpect':11A,104C 'upgrad':148C 'use':33B,69C 'user':144C 'variabl':119C 'version':150C 'win32':131C 'work':110C","nicknames":[],"mitigations":[],"who_affected":"Applications built on Apache Qpid Proton C with the OpenSSL TLS backend that rely on the custom trusted CA APIs to restrict which peer certificates are accepted. Windows builds using SChannel are not affected, per the sources. Teams that do not call the trusted CA setters or do not use OpenSSL TLS can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T11:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105031","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105031","severity":null,"published_at":"2026-10-29T11:17:24+00:00","modified_at":"2026-10-29T11:17:24+00:00","first_seen_at":"2026-10-29T11:24:27+00:00","fetched_at":"2026-10-29T11:24:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}