{"id":"CVE-2026-114230","kind":"vulnerability","aliases":["CVE-2026-114230"],"related":[],"title":"Apache Qpid Proton C: crafted AMQP frames can bypass peer authentication","description":"When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.","summary":"Apache Qpid Proton C dispatches AMQP frames that claim to be SASL frames during peer authentication, so an attacker can skip authentication. The application sees no user name, and the effect depends on how it handles that state.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["amqp","messaging","package","qpid-proton"],"not_affected_if":["no-amqp-listener","proton-c-0.41.1-or-later"],"how_to_check":"- Check the installed Proton C version (`qpid-proton` package or the library your build links against) and see whether it is `0.40.0` or earlier.\n- Look for applications that accept AMQP connections from untrusted peers and rely on SASL authentication.","fix":"- Apache Qpid Proton C: upgrade to `0.41.1`.","status":"open","published_at":"2026-10-29T11:17:28+00:00","first_seen_at":"2026-10-29T11:24:27+00:00","triaged_at":"2026-10-29T11:25:42+00:00","updated_at":"2026-10-29T11:25:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-29T11:25:42Z","model":"claude-haiku-5-5","output":{"fix":"- Apache Qpid Proton C: upgrade to `0.41.1`.","reach":"network","title":"Apache Qpid Proton C: crafted AMQP frames can bypass peer authentication","impact":"high","summary":"Apache Qpid Proton C dispatches AMQP frames that claim to be SASL frames during peer authentication, so an attacker can skip authentication. The application sees no user name, and the effect depends on how it handles that state.","audience":"developers","category":"package","nicknames":[],"who_cares":["qpid-proton","amqp","messaging"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"peer authenticates without credentials, bypassing SASL checks","analyst_note":"Confirm from the Apache Qpid Proton advisory which application behaviours turn the missing user name into real access; the NVD entry alone does not say.","how_to_check":"- Check the installed Proton C version (`qpid-proton` package or the library your build links against) and see whether it is `0.40.0` or earlier.\n- Look for applications that accept AMQP connections from untrusted peers and rely on SASL authentication.","plain_action":"","needs_analyst":true,"not_affected_if":["proton-c-0.41.1-or-later","no-amqp-listener"],"who_is_affected":"Applications that link Apache Qpid Proton C 0.40.0 or earlier and accept AMQP connections where SASL authentication decides access. The sources do not say how the application must handle the missing user name for the bypass to matter, so the exact exposure depends on the application's own checks.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":4174,"output_tokens":584,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114230':14A,17A '-2026':13A,16A '0.40.0':124C '0.41.1':132C 'affect':118C 'allow':84C 'also':72C 'amqp':6A,18B,29B,74C 'apach':1A,24B,119C 'applic':47B,102C 'attack':42B 'authent':11A,39B,45B,67C,85C,111C 'bypass':9A,86C 'c':4A,27B,122C 'claim':32B,78C 'complet':114C 'condit':106C 'craft':5A 'cve':12A,15A 'deal':103C 'depend':55B,98C 'dispatch':28B,63C,73C 'effect':54B,97C 'fix':134C 'frame':7A,30B,36B,65C,75C,82C 'handl':59B 'howev':87C 'issu':117C,136C 'mean':109C 'messag':19B 'name':51B,93C 'otherwis':108C 'packag':20B 'peer':10A,38B,69C 'proton':3A,23B,26B,70C,121C 'qpid':2A,22B,25B,120C 'qpid-proton':21B 'recommend':127C 'sasl':35B,64C,81C 'see':48B 'set':94C 'skip':44B 'state':61B 'upgrad':129C 'user':50B,92C,125C 'version':131C 'yet':115C","nicknames":[],"mitigations":[],"who_affected":"Applications that link Apache Qpid Proton C 0.40.0 or earlier and accept AMQP connections where SASL authentication decides access. The sources do not say how the application must handle the missing user name for the bypass to matter, so the exact exposure depends on the application's own checks.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T11:17:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114230","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114230","severity":null,"published_at":"2026-10-29T11:17:28+00:00","modified_at":"2026-10-29T11:17:28+00:00","first_seen_at":"2026-10-29T11:24:27+00:00","fetched_at":"2026-10-29T11:24:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}