Live › vulnerability › CVE-2026-114230
Apache Qpid Proton C dispatches AMQP frames that claim to be SASL frames during peer authentication, so an attacker can skip authentication. The application sees no user name, and the effect depends on how it handles that state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 11:24 UTC. All times on this page are UTC.
Applications that link Apache Qpid Proton C 0.40.0 or earlier and accept AMQP connections where SASL authentication decides access. The sources do not say how the application must handle the missing user name for the bypass to matter, so the exact exposure depends on the application's own checks.
No product ranges from the sources yet.
qpid-proton package or the library your build links against) and see whether it is 0.40.0 or earlier.0.41.1.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-114230")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.