---
id: "CVE-2026-114230"
kind: "vulnerability"
aliases: ["CVE-2026-114230"]
title: "Apache Qpid Proton C: crafted AMQP frames can bypass peer authentication"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["amqp", "messaging", "package", "qpid-proton"]
not_affected_if: ["no-amqp-listener", "proton-c-0.41.1-or-later"]
published_at: "2026-10-29T11:17:28+00:00"
first_seen_at: "2026-10-29T11:24:27+00:00"
updated_at: "2026-10-29T11:25:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114230", "first_seen_at": "2026-10-29T11:24:27+00:00"}]
---

# Apache Qpid Proton C: crafted AMQP frames can bypass peer authentication

Apache Qpid Proton C dispatches AMQP frames that claim to be SASL frames during peer authentication, so an attacker can skip authentication. The application sees no user name, and the effect depends on how it handles that state.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Proton C version (`qpid-proton` package or the library your build links against) and see whether it is `0.40.0` or earlier.
- Look for applications that accept AMQP connections from untrusted peers and rely on SASL authentication.

## Fix

- Apache Qpid Proton C: upgrade to `0.41.1`.

## Timeline

- 2026-10-29T11:24:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114230

## From the sources

When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.



This issue affects Apache Qpid Proton C: through 0.40.0.



Users are recommended to upgrade to version 0.41.1, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_