CVE-2026-77404: RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with url.Values. If an application accepts a TLS asset path containing ampersand or equals delimiters and later reparses the serialized URI with ParseURI, the embedded delimiters can create or overwrite connection options, including paths to TLS certificate, key, or CA files. This can corrupt connection configuration or select unintended local cryptographic assets. This issue is fixed in version 1.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQ amqp091-goto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using RabbitMQ amqp091-go before 1.13.0 are exposed only when they accept TLS asset paths or the TLS server name containing ampersand or equals characters, serialize the connection with URI.String, and later reparse that URI with ParseURI.
What does an attacker need to exploit it?
An attacker needs a way to influence a TLS certificate, key, CA certificate path, or server-name value that is included in the serialized AMQPS URI. The injected value must contain query-string delimiters such as ampersand or equals and the application must reparse the resulting URI.
What can happen if exploitation succeeds?
Injected query parameters can create or overwrite connection options, including the configured paths for TLS certificate, private key, or CA files. This can corrupt the connection configuration or cause the client to select unintended local cryptographic assets.
What should teams do if they cannot upgrade immediately?
Prevent untrusted input from reaching TLS asset path and server-name fields used to build AMQPS URIs, especially values containing ampersand or equals characters. Avoid serializing and reparsing such URIs where possible.