CVE-2026-114230
Description
A flaw was found in qpid-proton. When authenticating a peer connection using Simple Authentication and Security Layer (SASL), the software improperly processes Advanced Message Queuing Protocol (AMQP) frames that falsely claim to be SASL frames. A remote attacker can exploit this flaw by sending specially crafted frames during connection negotiation to bypass authentication, potentially gaining unauthorized access depending on how the receiving application handles incomplete authentication states.
Statement
This vulnerability is rated as Important because an unauthenticated remote attacker can bypass connection-level SASL authentication mechanisms over the network, potentially gaining unauthorized access to message broker resources. While the protocol negotiation flaw allows AMQP frames to be accepted without completing the credential exchange, no user identity is established in the connection context. Consequently, the actual security impact is contingent upon whether the downstream application allows unauthenticated actions or enforces mandatory identity checks before granting access to queues and topics.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
