CVE-2026-106123: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQ Java clientto a version that resolves this vulnerability.Fixed in 5.35.0
Event History
Frequently Asked Questions
Which applications are exposed to credential disclosure?
Applications using the RabbitMQ Java client before version 5.35.0 are exposed if they call ConnectionFactoryConfigurator.load() with an AMQP URI containing plaintext credentials and URI parsing fails. The credentials can then appear in startup logs, APM systems, CI logs, or copied stack traces.
What must happen for credentials to be leaked?
An AMQP URI parsing failure must occur in ConnectionFactoryConfigurator.load(). The URI must include a plaintext username and password for those credentials to be included in the wrapped exception message.
What should teams do if logs may already contain leaked credentials?
Upgrade to version 5.35.0, then review locations that may have captured exception output, including startup logs, APM systems, CI logs, and shared stack traces. Treat any broker credentials found in those records as disclosed.