Qpid Proton C CVE-2026-114230

Applies to applications that use Apache Qpid Proton C through 0.40.0 as the AMQP/SASL endpoint and rely on its SASL layer for peer authentication; the attacker must be able to reach the AMQP listener during connection setup and send a crafted frame that claims to be a SASL frame. The key LIMITING factor, per the advisory, is that the bypass leaves no user name set, so authentication has effectively not completed - realized impact depends entirely on how the hosting application treats an identity-less session (an app that denies unauthenticated/anonymous access sharply limits exploitation, whereas one that proceeds with a default or trusted identity is exposed). The upgrade to 0.41.1 is the stated fix.

This is an authentication-bypass flaw (PROTON-2945) in Apache Qpid Proton C through 0.40.0, where frames that claim to be SASL frames are dispatched even when they are actually AMQP performatives, letting a peer proceed past SASL authentication. No CVSS vector, EPSS score, or SSVC exploitation value is supplied in the input, and the vuln.today Decision label is 'awaiting_data', so quantitative exploitation signals are absent rather than reassuring. The flaw is not listed in CISA KEV and no verified working exploit code is referenced, so there is no confirmed active exploitation. The most important nuance, stated explicitly in the advisory, is that the bypass leaves no user name set, so the real-world impact is conditional on how each consuming application handles an authenticated session that has no established identity - an application that treats 'no identity' as unauthorized may be largely unaffected, while one that defaults to a trusted/anonymous identity could expose protected messaging operations. Because impact is application-dependent and no severity metrics were provided, treat this as a credible authentication-integrity issue warranting prompt patching for exposed AMQP endpoints, but note that blast radius cannot be precisely rated from the available data - confirm with the vendor/JIRA and your own application's post-SASL authorization logic.

An attacker who can reach an AMQP listener built on Qpid Proton C (≤0.40.0) opens a connection and, during the SASL handshake phase, sends an AMQP performative that is accepted as if it were a SASL frame, causing the library to proceed as though authentication was negotiated even though no user name was established. Whether this yields unauthorized messaging access depends on how the hosting application authorizes a session with no identity. No verified working exploit code is referenced in the available sources.