Qpid Proton C through 0.40.0 can treat AMQP frames as SASL
Original title: CVE-2026-114230: Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
Apache calls the flaw important: peers can send regular AMQP frames that Proton dispatches as SASL, with no username set.
Andrew Stitcher disclosed CVE-2026-114230 in Apache Qpid Proton C through 0.40.0. When dispatching SASL frames to authenticate a peer, Proton also dispatches AMQP frames that claim to be SASL frames, which the report says allows authentication bypass. No user name is set, so impact depends on how the application treats an incomplete authentication. Apache rates severity important. The snippet does not name a fixed version.
Unconfirmed: The truncated post does not state a fixed version or known exploitation.
- Affected product is Apache Qpid Proton C through 0.40.0.
- Bypass occurs because AMQP frames can be accepted as SASL frames.
- No username is set after the bypass.
- Application handling of unfinished authentication determines the effect.
Impact: Authentication bypass with no username set
| Product | Affected |
|---|---|
| Apache Qpid Proton C | through 0.40.0 |
- CVEs
- CVE-2026-114230
- Vendors
- Apache
- Products
- Qpid Proton C
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-114230 | SASL authentication bypass in Apache Qpid Proton C through 0.40.0 | — | — |
From the original article
Posted by Andrew Stitcher on Oct 28 Severity: important Affected versions: - Apache Qpid Proton C through 0. 40. 0 Description: When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.