Read the docs
TI-2026-68642 Aliases CVE-2026-106123GHSA-h6w7-qmcm-q6xr

RabbitMQ Java client leaks broker credentials in exception messages

Priority LOW 25CWE-209Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 2 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-209.

Summary

The RabbitMQ Java client before 5.35.0 includes the raw URI in wrapped exceptions when ConnectionFactoryConfigurator.load() fails to parse an AMQP URI. The URI can contain a plaintext username and password, so the error messages expose them (CWE-209). A local user with low privileges who can read startup logs, monitoring data or copied stack traces can obtain broker credentials. The references include a link to an exploit.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00239 15th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial rabbitmq-java-client (rabbitmq): 5.35.0amqp-client (com.rabbitmq): 5.35.0+1 more productRed Hat: 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rabbitmqrabbitmq-java-clientbefore 5.35.05.35.0Patch availableCNA
VMwareamqp-clientbefore 5.35.05.35.0Patch availableCNA
—com.rabbitmq:amqp-client (Maven)before 5.35.05.35.0Patch availableGHSA-h6w7-qmcm-q6xr
  • rabbitmq-java-client Vendorrabbitmq Affected before 5.35.0 Fixed in 5.35.0 Patch available CNA
  • amqp-client VendorVMware Affected before 5.35.0 Fixed in 5.35.0 Patch available CNA
  • com.rabbitmq:amqp-client (Maven) Vendor— Affected before 5.35.0 Fixed in 5.35.0 Patch available GHSA-h6w7-qmcm-q6xr

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:*before 5.35.0VulnerableVMware
  • cpe:2.3:a:vmware:rabbitmq_java_client:*:*:*:*:*:*:*:* Versions before 5.35.0 Vulnerable ·VMware

Remediation

Use version 5.35.0 or later of the RabbitMQ Java client, which is the fixed version for rabbitmq-java-client, com.rabbitmq amqp-client and the Maven artifact com.rabbitmq:amqp-client. Red Hat Fuse 7 is affected with no fix planned, and Red Hat build of Apache Camel 4 for Quarkus 3 is affected with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA rabbitmq-java-client (rabbitmq) Fixed in 5.35.0
  • Fix · CNA amqp-client (com.rabbitmq) Fixed in 5.35.0
  • Fix · GHSA-h6w7-qmcm-q6xr com.rabbitmq:amqp-client (Maven) Fixed in 5.35.0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-06 Threatist record created from CVE-2026-106123
  2. 2026-10-07 Alias added: GHSA-h6w7-qmcm-q6xr
  3. 2026-10-07 Fix available: Maven/com.rabbitmq:[email protected] · GHSA-h6w7-qmcm-q6xr
  4. 2026-10-07 CVSS score added · GHSA-h6w7-qmcm-q6xr
  5. 2026-10-07 Weakness changed · GHSA-h6w7-qmcm-q6xr
  6. 2026-10-07 6 new references · GHSA-h6w7-qmcm-q6xr
  7. 2026-10-09 CVSS score added · NVD
  8. 2026-10-20 Weakness changed · CNA
  9. 2026-10-20 CVSS score changed · GHSA-h6w7-qmcm-q6xr
  10. 2026-10-20 Weakness changed · GHSA-h6w7-qmcm-q6xr
  11. 2026-11-04 Affected versions changed · Red Hat
  12. 2026-11-04 CVSS score added · Red Hat

References

Exploit 1

Patch 2

Advisory 1

Other 2

  • TI-2026-41154 Improper authentication in rabbitmq-server CVSS 3.1CRITICAL 10.0
  • TI-2026-41149 RabbitMQ: UNC SSRF affecting the management UI on Windows CVSS 3.1CRITICAL 10.0
  • TI-2026-41158 Resource allocation without limits in rabbitmq-server CVSS 3.1HIGH 7.5
  • TI-2026-47695 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CVSS 4.0HIGH 8.2
  • TI-2026-47694 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CVSS 4.0HIGH 8.2
  • TI-2026-45167 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading CVSS 4.0HIGH 7.5
See all 100 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences