CVE-2026-105031: Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.

As cited

Copy frozen at 2026-10-28 23:40 UTC (site build).

vulnerabilities

CVE-2026-105031: Apache Qpid Proton C: The OpenSSL TLS implementation adds a locally trusted certificate authority to the existing trusted system trust anchors.

Apache Qpid Proton C versions through 0.40.0 contain a flaw in the OpenSSL TLS implementation where the pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() APIs add a locally trusted certificate authority to system trust anchors rather than replacing them. This behavior could lead to acceptance of unexpected peer certificates. The issue can be mitigated by setting the SSL_CERT_FILE environment variable.

Why it matters: Organizations using Apache Qpid Proton C must update to a patched version or apply the workaround to prevent man-in-the-middle attacks where malicious or unauthorized certificates could be trusted in TLS connections.

Source published

2026-10-28 20:42 UTC

First seen by Cybersecurity Tracker

2026-10-28 22:53 UTC