CVE-2026-77407
RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields
- State
- Published
- Severity
- 7.0 High
- Published
- Sep 16, 2026
- Updated
- Sep 16, 2026
- Reserved
- Aug 20, 2026
Description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.0 High | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L | GitHub_M |
Weaknesses
- CWE-316 Cleartext Storage of Sensitive Information in Memory
Affected Products
| Product | Versions |
|---|---|
amqp091-gorabbitmq |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.