---
id: "CVE-2026-105031"
kind: "vulnerability"
aliases: ["CVE-2026-105031"]
title: "Apache Qpid Proton C: OpenSSL builds trust system CAs, accepting unexpected peer certificates"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["amqp", "messaging", "openssl", "package", "qpid-proton"]
not_affected_if: ["no-custom-trust-anchors", "schannel-tls"]
published_at: "2026-10-29T11:17:24+00:00"
first_seen_at: "2026-10-29T11:24:27+00:00"
updated_at: "2026-10-29T11:25:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105031", "first_seen_at": "2026-10-29T11:24:27+00:00"}]
---

# Apache Qpid Proton C: OpenSSL builds trust system CAs, accepting unexpected peer certificates

When the OpenSSL TLS backend is used, the trusted CA APIs added certificates to the system trust anchors instead of replacing them. An attacker holding a certificate signed by any system-trusted authority may be accepted as a TLS peer.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the application links Apache Qpid Proton C with the OpenSSL TLS implementation (not Win32 SChannel).
- Check the installed Proton version against the affected range, `0.40.0` and earlier.
- Check whether the application calls `pn_ssl_domain_set_trusted_ca_db()` or `pn_tls_config_set_trusted_certs()`.

## Fix

- Apache Qpid Proton C: upgrade to `0.41.1`.
- Workaround stated in the sources: set the `SSL_CERT_FILE` environment variable for the application to `/dev/null`.

## Timeline

- 2026-10-29T11:24:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105031

## From the sources

When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.



This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.



This issue does not affect the Win32 SChannel TLS implementation.



This issue affects Apache Qpid Proton C: through 0.40.0.



Users are recommended to upgrade to version 0.41.1, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_