CVE-2026-77407: RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
RabbitMQ amqp091-goto a version that resolves this vulnerability.Fixed in 1.13.0
Event History
Frequently Asked Questions
Who is exposed to credential disclosure?
Applications using amqp091-go before 1.13.0 with PLAIN authentication are exposed if code or tooling can access a live Connection object. This includes reflective loggers, APM agents, debugging utilities, and panic handlers that traverse connection configuration.
Does exploitation require network access or an additional authentication attempt?
The disclosed password is retained after a successful PLAIN authentication handshake for the lifetime of the connection. Exposure requires access to the Connection object or captured application state; the described issue does not require another AMQP authentication attempt.
How can I determine whether an application is affected?
Check whether it uses amqp091-go prior to 1.13.0 and authenticates with PlainAuth/PLAIN. Then review whether Connection objects may be logged, reflected over, included in panic reports, or collected by monitoring or debugging tools.
What should be done if upgrading is not immediately possible?
Avoid logging, serializing, reflecting over, or retaining live Connection objects in diagnostics and monitoring captures. Treat credentials used by affected long-lived connections as potentially exposed where such state collection has occurred.