CVE-2026-114230 Apache Qpid Proton C: Potential authentication bypass: regular AMQP frames can be sent as SASL frames
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-114230?
CVE-2026-114230 is a vulnerability in Apache Qpid Proton C, published on 29 Oct 2026.
Official description
When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL frames. This allows authentication bypass. However there will be no user name set so the effects depend on how the application deals with this condition - which otherwise means that authentication has not completed yet.
This issue affects Apache Qpid Proton C: through 0.40.0.
Users are recommended to upgrade to version 0.41.1, which fixes the issue.
Weakness: CWE-305
Which versions are affected by CVE-2026-114230?
How do I fix CVE-2026-114230?
No fix has been published for CVE-2026-114230 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-114230 being exploited?
There is no known exploitation of CVE-2026-114230 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2026-114230, GHSA-v3qr-mjxm-7376.