CVE-2026-114230 in Qpid Proton
Summary
by MITRE • 10/29/2026
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/29/2026
The vulnerability described involves a critical flaw in the Simple Authentication and Security Layer (SASL) implementation within Apache Qpid Proton C versions up through 0.40.0. The core technical deficiency lies in how the library processes incoming frames during the authentication handshake phase. Specifically, when dispatching SASL frames to authenticate a peer, the application logic fails to strictly validate that the received data is indeed a valid SASL frame before processing it as such. Instead, if an AMQP frame claims to be a SASL frame, the system accepts and processes it without sufficient verification of its structural integrity or protocol compliance. This lack of rigorous type checking allows an attacker to inject malformed or misidentified frames into the authentication stream, effectively bypassing the intended security controls designed to verify peer identity before establishing a trusted session.
From a technical perspective, this flaw represents a failure in input validation and state machine enforcement during the initial connection phase. The vulnerability aligns with CWE-20 Improper Input Validation, as the application accepts data that does not conform to expected protocol specifications without adequate sanitization or type checking. Furthermore, it relates to CWE-345 Insufficient Verification of Data Authenticity because the system trusts a frame based on its claimed identity rather than verifying its actual content against established security protocols. In the context of the MITRE ATT&CK framework, this behavior facilitates Initial Access by allowing an adversary to bypass authentication mechanisms, potentially categorized under T1078 Valid Accounts if combined with other techniques or simply as a method to establish unauthorized access through protocol manipulation.
The operational impact of this vulnerability is contingent upon how the consuming application handles the state where no username has been set due to the incomplete or failed authentication process. Since the bypass results in a session that appears active but lacks proper user identification, the severity depends on the downstream logic. If an application assumes that any established connection implies successful authentication, it may grant access to sensitive resources without verifying credentials. However, if the application strictly checks for a populated username field before proceeding with privileged operations, the impact might be limited to denial of service or failed connections rather than full unauthorized access. Nevertheless, relying on such secondary checks is insecure practice and introduces significant risk in environments where automated systems assume authentication completion upon connection establishment.
To mitigate this vulnerability, users are strongly advised to upgrade Apache Qpid Proton C to version 0.41.1 or later, which contains the necessary code corrections to enforce strict frame type validation during SASL negotiation. In addition to upgrading, developers should implement defense-in-depth strategies by explicitly verifying that authentication has completed and a valid user identity is present before granting any access rights. This includes checking for null or empty username fields in session objects and ensuring that state transitions from unauthenticated to authenticated states are strictly controlled by the library's internal logic rather than external assumptions. Regular security audits of AMQP implementations should also include testing for protocol confusion attacks where frame types are misidentified, ensuring robustness against similar bypass techniques in future updates.