Apache Qpid Proton C uses OpenSSL for TLS where the pn_ssl_domain_set_trusted_ca_db and pn_tls_config_set_trusted_certs APIs add a locally trusted certificate authority to the system trust anchors instead of replacing the default set. This behavior can cause the library to trust peer certificates that should not be trusted, enabling an attacker to present a malicious certificate signed by an attacker‑controlled CA and successfully masquerade as a legitimate peer. The result is a potential man‑in‑the‑middle that can intercept or modify traffic, compromise confidentiality and integrity, and potentially gain access to protected services. The flaw is classified as CWE‑295.

Apache Qpid Proton C through version 0.40.0 is affected. The issue does not impact the Win32 SChannel TLS implementation. The vulnerability is present in releases up to and including 0.40.0 and is fixed in 0.41.1 and later.

Because the defect allows local certificates to be added to the trusted chain, any entity that can provide a certificate signed by a locally trusted authority can bypass normal verification. An attacker need only supply such a certificate during a TLS handshake, and no elevated privileges or special configuration are required. While an explicit CVSS score is not available, the potential for arbitrary trust elevation suggests a high severity for confidentiality and integrity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, indicating that it has not yet been widely exploited in the wild. Nonetheless, the risk remains significant for systems that rely on OpenSSL TLS in Qpid Proton C and cannot mitigate the issue immediately.