Zero Radar
← feed
HighVulnerabilityCVE-2026-105031updated 29 Oct 2026, 11:22 UTC

Apache Qpid Proton C may trust unintended TLS certificates

A library used to run encrypted connections can accept certificates it should reject, so an impostor server or client could slip past the security check. Updating the library closes this gap.

Fixed in Apache Qpid Proton C 0.41.1Official, 2 sources
SeverityHighVulnerability
Being exploited?UnclearNo reports either way yet
Fix available?YesApache Qpid Proton C 0.41.1 · since 29 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker obtains certificateCertificate issued by any system-trusted authority
  2. 2Attacker intercepts connectionPosing as the expected broker or peer
  3. 3Library accepts certificateExtra trust anchors wrongly added to defaults
  4. 4Traffic exposedEncrypted session is no longer trustworthy
  5. ResultAttacker impersonates a trusted peer

What happened

When built with OpenSSL, the pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() APIs add trusted certificate authorities to the system defaults instead of replacing them, allowing unexpected peer certificates to be trusted.

Why it is dangerous: Connections can be intercepted or spoofed by attackers holding certificates issued by any system-trusted authority, risking data exposure and impersonation of message brokers or peers.

Are you affected?

You are affected if you use Apache Qpid Proton C through 0.40.0 with the OpenSSL TLS implementation (the Win32 SChannel implementation is not affected).

Apache Qpid Proton C through 0.40.0 (OpenSSL TLS implementation)

What to do

  1. Upgrade Apache Qpid Proton C to version 0.41.1 or later
  2. If you cannot upgrade yet, set the SSL_CERT_FILE environment variable for the application to /dev/null as a workaround

Timeline

  1. 28 Oct 2026, 20:42 UTC
    Publicly disclosed
  2. 28 Oct 2026, 20:42 UTC
    Reported by oss-security · oss-security
  3. 28 Oct 2026, 20:46 UTC
    Picked up by Zero Radar
  4. 29 Oct 2026, 11:22 UTC
    NVD reported on it · NVD

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Security researchers research teams and mailing lists

Technical details

ID
CVE-2026-105031
Disclosed
28 Oct 2026, 20:42 UTC
On Zero Radar
28 Oct 2026, 20:46 UTC (4 min after disclosure)
Last change
29 Oct 2026, 11:22 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Apache Qpid Proton C may trust unintended TLS certificates · Zero Radar