CVE-2026-105031

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-105031", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-02T21:28:25.620Z", "datePublished": "2026-10-29T10:16:41.384Z", "dateUpdated": "2026-11-05T21:28:21.353Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-29T10:16:41.384Z"}, "title": "Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.", "problemTypes": [{"descriptions": [{"description": "CWE-295 Improper certificate validation", "lang": "en", "cweId": "CWE-295", "type": "CWE"}]}], "source": {"defect": ["PROTON-2976"], "discovery": "INTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Proton C", "packageURL": "pkg:software-id/apache.org/qpid-proton", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "0.40.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() &\u00a0pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() &amp;&nbsp;pn_tls_config_set_trusted_certs() APIs <b>added</b> to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.</p><p>This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.</p><p>This issue does not affect the Win32 SChannel TLS implementation.</p><p>This issue affects Apache Qpid Proton C: through 0.40.0.</p><p>Users are recommended to upgrade to version 0.41.1, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/22"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-29T11:08:28.567Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:28:04.274915Z", "id": "CVE-2026-105031", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:28:21.353Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/22"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-29T11:08:28.567Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-105031", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T21:28:04.274915Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:28:16.388Z"}}], "cna": {"title": "Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.", "source": {"defect": ["PROTON-2976"], "discovery": "INTERNAL"}, "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Proton C", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.40.0"}], "packageURL": "pkg:software-id/apache.org/qpid-proton", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() &\u00a0pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() &amp;&nbsp;pn_tls_config_set_trusted_certs() APIs <b>added</b> to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.</p><p>This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.</p><p>This issue does not affect the Win32 SChannel TLS implementation.</p><p>This issue affects Apache Qpid Proton C: through 0.40.0.</p><p>Users are recommended to upgrade to version 0.41.1, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-295", "description": "CWE-295 Improper certificate validation"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-29T10:16:41.384Z"}}}, "cveMetadata": {"cveId": "CVE-2026-105031", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:28:21.353Z", "dateReserved": "2026-10-02T21:28:25.620Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-10-29T10:16:41.384Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:software-id/apache.org/qpid-proton", "product": "Apache Qpid Proton C", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "0.40.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() &\u00a0pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\n\n\n\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\n\n\n\nThis issue does not affect the Win32 SChannel TLS implementation.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."}], "id": "CVE-2026-105031", "lastModified": "2026-11-05T22:17:42.630", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-105031", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:28:04.274915Z", "version": "2.0.3"}}]}, "published": "2026-10-29T11:17:24.290", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/28/22"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-295"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "qpid-proton: qpid-proton: improper certificate validation via retention of default system trust anchors", "id": "2563304", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563304"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-295", "details": ["When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() &\u00a0pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.\nThis can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.\nThis issue does not affect the Win32 SChannel TLS implementation.\nThis issue affects Apache Qpid Proton C: through 0.40.0.\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.", "A flaw was found in qpid-proton. When configuring custom trusted certificates with the OpenSSL Transport Layer Security (TLS) implementation, the library appends the certificates to default system trust anchors instead of replacing them. This improper certificate validation can allow a remote attacker presenting a certificate issued by any standard system Certificate Authority (CA) to be trusted by the application, potentially permitting unauthorized connections or interception of communications."], "mitigation": {"lang": "en:us", "value": "Configure the environment of affected processes to override the default OpenSSL certificate store path to `/dev/null`. This ensures that only explicitly configured CA certificates are trusted.\nFor standalone or shell-executed processes:\n```\nexport SSL_CERT_FILE=/dev/null\n```\nFor systemd-managed services, create or edit a drop-in override (e.g., using `systemctl edit <service_name>`):\n```\n[Service]\nEnvironment=\"SSL_CERT_FILE=/dev/null\"\n```\nApply the changes by reloading systemd and restarting the service:\n```\nsystemctl daemon-reload\nsystemctl restart <service_name>\n```\nCaveats:\nSetting `SSL_CERT_FILE=/dev/null` disables loading of standard operating system CA certificates. Any connection depending on system-wide root CAs will fail certificate verification unless explicitly added to the application's trust store.\nWarning: Restarting services will terminate active network connections and interrupt in-flight message delivery."}, "name": "CVE-2026-105031", "package_state": [{"cpe": "cpe:/a:redhat:amq_clients:2023", "fix_state": "Affected", "package_name": "qpid-proton", "product_name": "Red Hat AMQ Clients"}, {"cpe": "cpe:/a:redhat:openstack:13", "fix_state": "Affected", "package_name": "qpid-proton", "product_name": "Red Hat OpenStack Platform 13 (Queens)"}, {"cpe": "cpe:/a:redhat:openstack:16.2", "fix_state": "Affected", "package_name": "qpid-proton", "product_name": "Red Hat OpenStack Platform 16.2"}, {"cpe": "cpe:/a:redhat:openstack:17.1", "fix_state": "Affected", "package_name": "qpid-proton", "product_name": "Red Hat OpenStack Platform 17.1"}, {"cpe": "cpe:/a:redhat:service_interconnect:2", "fix_state": "Affected", "package_name": "qpid-proton", "product_name": "Red Hat Service Interconnect 2"}], "public_date": "2026-10-29T10:16:41Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-105031\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-105031\nhttps://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4"], "statement": "This vulnerability is rated as Important severity because applications configured to restrict TLS trust to specific custom certificate authorities inadvertently retain the operating system's default root certificates. This behavior allows attackers capable of intercepting network traffic to authenticate using certificates signed by any trusted public authority. Red Hat environments utilizing AMQ, OpenStack, or Service Interconnect where isolated trust domains are expected are potentially susceptible to man-in-the-middle attacks. Although exploiting this flaw requires an adversary to occupy a privileged network position, successful exploitation compromises the confidentiality and integrity of message exchange.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.40.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Qpid Proton C", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "qpid_proton-c", "vendor": "apache"}], "created": "2026-10-29T11:30:14.464437+00:00", "updated": "2026-11-05T23:45:07.706623+00:00", "vendors": ["apache", "apache$PRODUCT$qpid_proton-c"]}