RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 7 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| rabbitmq | amqp091-go | before 1.13.0 | 1.13.0 | Patch available | CNA |
| — | github.com/rabbitmq/amqp091-go (Go) | before 1.13.0 | 1.13.0 | Patch available | GHSA-27gv-rfvv-22mv |
- amqp091-go Vendorrabbitmq Affected before 1.13.0 Fixed in 1.13.0 Patch available CNA
- github.com/rabbitmq/amqp091-go (Go) Vendor— Affected before 1.13.0 Fixed in 1.13.0 Patch available GHSA-27gv-rfvv-22mv
Remediation
- Fix · CNA amqp091-go (rabbitmq) Fixed in 1.13.0
- Fix · GHSA-27gv-rfvv-22mv github.com/rabbitmq/amqp091-go (Go) Fixed in 1.13.0 Advisory →
Red Hat 1 advisory
- RHSA-2026:68290 Released 2026-09-16 · Red Hat rating ImportantRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images opentelemetry-collector-contrib-0.161.0-0.1.hum1@aarch64, opentelemetry-collector-contrib-0.161.0-0.1.hum1@src, opentelemetry-collector-contrib-0.161.0-0.1.hum1@x86_64
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 4 | Affected | No fix yet: Fix deferred |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Multicluster Global Hub | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat OpenStack Platform 18.0 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Hardened Images | Fixed | RHSA-2026:68290 |
Not affected: 1 product
- Custom Metric Autoscaler operator for Red Hat Openshift
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77407
- 2026-10-03 Alias added: GHSA-27gv-rfvv-22mv
References
Other 5
- https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv
- https://github.com/rabbitmq/amqp091-go/pull/350
- https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f
- https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0
- https://github.com/rabbitmq/amqp091-go
More rabbitmq vulnerabilities
- TI-2026-41154 Improper authentication in rabbitmq-server CVSS 3.1CRITICAL 10.0
- TI-2026-41149 RabbitMQ: UNC SSRF affecting the management UI on Windows CVSS 3.1CRITICAL 10.0
- TI-2026-41158 Resource allocation without limits in rabbitmq-server CVSS 3.1HIGH 7.5
- TI-2026-47695 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CVSS 4.0HIGH 8.2
- TI-2026-47694 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CVSS 4.0HIGH 8.2
- TI-2026-45167 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading CVSS 4.0HIGH 7.5
Sources
- CVE-2026-77407 · CVE Program
- CVE-2026-77407 · NVD
- FIRST EPSS
- GHSA-27gv-rfvv-22mv · GitHub Advisory Database · CC BY 4.0
- CVE-2026-77407 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences