CVE-2026-105031

CriticalCVSS 9.1/10Last modified Nov 5, 2026

Description

When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() & pn_tls_config_set_trusted_certs() APIs added to rather than replaced the default system trust anchors. Leading to potentially trusting unexpected peer certificates.

This can be worked around by setting the SSL_CERT_FILE environment variable for the application to /dev/null.

This issue does not affect the Win32 SChannel TLS implementation.

This issue affects Apache Qpid Proton C: through 0.40.0.

Users are recommended to upgrade to version 0.41.1, which fixes the issue.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Qpid Proton C	<= 0.40.0

References

Timeline

Published: Oct 29, 2026
Last modified: Nov 5, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1050329.1The EnergizeLab Eilik and EilikO AI skill upload endpoint, served by the FastAPI AI inference and profiling services, does not require authe CVE-2026-1050338.8The EnergizeLab AI Station (RK3562) firmware image ships with default root credentials and SSH enabled. An attacker with network access to t CVE-2026-1050348.2The EnergizeLab Eilik NestJS auth service issues device tokens for arbitrary robot serial numbers without authentication. An unauthenticated CVE-2026-1050357.8The EnergizeLab FirmwareUpdater (AArch64 ELF, distributed in the CDN bin.zip) uses a single hard-coded AES key shared by all installations. CVE-2026-1050367.5EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.1_20260617182218_release, and the EnergizeLab Windows desktop app 3.1.2 down CVE-2026-1050379.9EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary file CVE-2026-1050389.8The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication CVE-2026-1050399.6EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated CVE-2026-1050408.8The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user CVE-2026-1050429.8A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crash. This issue affects Apac CVE-2026-1050433.6MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will c CVE-2026-1050448.5Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in Qingteng Host Adaptive Sec