# CVE-2026-105031: Apache Qpid Proton C certificate validation bypass in TLS configuration

Source: https://junglewise.ai/threats/cve-2026-105031-when-using-the-openssl-tls-implementation-both-the-pn-ssl-domain  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-29. Updated: 2026-10-29  
License: CC BY 4.0 with a link back

CVE-2026-105031 · Severity: info · Published 2026-10-29

Apache Qpid Proton C is a messaging library used by applications to establish secure TLS connections. A flaw in its certificate validation logic causes custom trusted certificate configurations to be added to, rather than replace, the system's default trusted certificate store. This could allow an attacker with network access to impersonate legitimate services if their certificates are accepted by the system trust store, potentially leading to data interception or session hijacking.

Technologies: [Apache Qpid Proton C](https://junglewise.ai/threats/technologies/qpid-proton-c). Vendors: [Apache](https://junglewise.ai/threats/vendors/apache).

## Quick answers

**Is CVE-2026-105031 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105031 being exploited in the wild.

**How severe is CVE-2026-105031?** Informational severity, published 29 October 2026.

**Which products and versions are affected?** Apache Qpid Proton C through 0.40.0.

**Is there a fix for CVE-2026-105031?** Yes: fixed in 0.41.1. Until then: As a workaround, set the SSL_CERT_FILE environment variable to /dev/null for the application until an upgrade to version 0.41.1 or later is available. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-105031 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-105031?** Check whether you run Apache Qpid Proton C at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.41.1

As a workaround, set the SSL_CERT_FILE environment variable to /dev/null for the application until an upgrade to version 0.41.1 or later is available.

## Technical details

The pn_ssl_domain_set_trusted_ca_db() and pn_tls_config_set_trusted_certs() APIs in the OpenSSL TLS backend append custom certificates to the default system trust anchors instead of replacing them. This affects only the OpenSSL implementation; the Windows SChannel TLS backend is not vulnerable. The flaw allows an attacker on the network to exploit overly permissive certificate validation if the system trust store includes compromised or malicious certificates.

## Affected products

- Apache Qpid Proton C through 0.40.0

## Timeline

- 2026-10-29: disclosed

## References

- [https://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4](https://lists.apache.org/thread.html/lc10nrjt2dwcjjhrsgoyy5tqkntsnor4)

## Related threats

- [Apache Qpid Proton C stack read overflow in TLS certificate validation](https://junglewise.ai/threats/cve-2026-115942-a-misconfigured-wildcard-tls-certificate-causes-a-stack-read)
- [Apache Qpid Proton C SASL authentication bypass](https://junglewise.ai/threats/cve-2026-114230-when-dispatching-sasl-frames-to-authenticate-the-peer-proton)
- [Apache Qpid Proton C stack overflow in message body decoder](https://junglewise.ai/threats/cve-2026-105042-a-message-body-that-is-deeply-nested-and-decoded-by-pn-message)