CVE-2026-114230

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114230", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "state": "PUBLISHED", "assignerShortName": "apache", "dateReserved": "2026-10-21T05:27:42.658Z", "datePublished": "2026-10-29T10:19:15.580Z", "dateUpdated": "2026-11-05T21:29:56.557Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-29T10:19:15.580Z"}, "title": "Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames", "problemTypes": [{"descriptions": [{"description": "CWE-305 Authentication bypass by primary weakness", "lang": "en", "cweId": "CWE-305", "type": "CWE"}]}], "source": {"defect": ["PROTON-2945"], "discovery": "INTERNAL"}, "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Proton C", "packageURL": "pkg:software-id/apache.org/qpid-proton", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "0.40.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"value": "When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.", "lang": "en", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.</p><p>This issue affects Apache Qpid Proton C: through 0.40.0.</p><p>Users are recommended to upgrade to version 0.41.1, which fixes the issue.</p>"}]}], "references": [{"url": "https://lists.apache.org/thread.html/ob7vo6swpj4wbb2m3zq9q2vkwfg5dg8k", "tags": ["vendor-advisory"]}], "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "x_generator": {"engine": "Vulnogram 1.0.3"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/24"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-29T11:09:06.927Z"}}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T21:29:36.438652Z", "id": "CVE-2026-114230", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:29:56.557Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/10/28/24"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-29T11:09:06.927Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-114230", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-05T21:29:36.438652Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:29:52.055Z"}}], "cna": {"title": "Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames", "source": {"defect": ["PROTON-2945"], "discovery": "INTERNAL"}, "metrics": [{"other": {"type": "Textual description of severity", "content": {"text": "important"}}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Apache Software Foundation", "product": "Apache Qpid Proton C", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.40.0"}], "packageURL": "pkg:software-id/apache.org/qpid-proton", "defaultStatus": "unaffected"}], "references": [{"url": "https://lists.apache.org/thread.html/ob7vo6swpj4wbb2m3zq9q2vkwfg5dg8k", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.3"}, "descriptions": [{"lang": "en", "value": "When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.", "supportingMedia": [{"type": "text/html", "value": "<p>When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.</p><p>This issue affects Apache Qpid Proton C: through 0.40.0.</p><p>Users are recommended to upgrade to version 0.41.1, which fixes the issue.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-305", "description": "CWE-305 Authentication bypass by primary weakness"}]}], "providerMetadata": {"orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "shortName": "apache", "dateUpdated": "2026-10-29T10:19:15.580Z"}}}, "cveMetadata": {"cveId": "CVE-2026-114230", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:29:56.557Z", "dateReserved": "2026-10-21T05:27:42.658Z", "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09", "datePublished": "2026-10-29T10:19:15.580Z", "assignerShortName": "apache"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:software-id/apache.org/qpid-proton", "product": "Apache Qpid Proton C", "vendor": "Apache Software Foundation", "versions": [{"lessThanOrEqual": "0.40.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@apache.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.\n\n\n\nThis issue affects Apache Qpid Proton C: through 0.40.0.\n\n\n\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue."}], "id": "CVE-2026-114230", "lastModified": "2026-11-05T22:17:47.380", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-114230", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:29:36.438652Z", "version": "2.0.3"}}]}, "published": "2026-10-29T11:17:28.210", "references": [{"source": "security@apache.org", "url": "https://lists.apache.org/thread.html/ob7vo6swpj4wbb2m3zq9q2vkwfg5dg8k"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/28/24"}], "sourceIdentifier": "security@apache.org", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-305"}], "source": "security@apache.org", "type": "Secondary"}]}

{"bugzilla": {"description": "qpid-proton: qpid-proton: Authentication bypass via misidentified AMQP frames", "id": "2563307", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563307"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-305", "details": ["When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.\nThis issue affects Apache Qpid Proton C: through 0.40.0.\nUsers are recommended to upgrade to version 0.41.1, which fixes the issue.", "A flaw was found in qpid-proton. When authenticating a peer connection using Simple Authentication and Security Layer (SASL), the software improperly processes Advanced Message Queuing Protocol (AMQP) frames that falsely claim to be SASL frames. A remote attacker can exploit this flaw by sending specially crafted frames during connection negotiation to bypass authentication, potentially gaining unauthorized access depending on how the receiving application handles incomplete authentication states."], "name": "CVE-2026-114230", "public_date": "2026-10-29T10:19:15Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114230\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114230\nhttps://lists.apache.org/thread.html/ob7vo6swpj4wbb2m3zq9q2vkwfg5dg8k"], "statement": "This vulnerability is rated as Important because an unauthenticated remote attacker can bypass connection-level SASL authentication mechanisms over the network, potentially gaining unauthorized access to message broker resources. While the protocol negotiation flaw allows AMQP frames to be accepted without completing the credential exchange, no user identity is established in the connection context. Consequently, the actual security impact is contingent upon whether the downstream application allows unauthenticated actions or enforces mandatory identity checks before granting access to queues and topics.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,0.40.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Apache Qpid Proton C", "source": "cna", "vendor": "Apache Software Foundation"}, "product": "qpid_proton-c", "vendor": "apache"}], "created": "2026-10-29T11:30:14.464305+00:00", "updated": "2026-11-05T23:30:16.314557+00:00", "vendors": ["apache", "apache$PRODUCT$qpid_proton-c"]}