Vulnerability Description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.
Related Weaknesses (CWE)
References
- https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4
- https://github.com/rabbitmq/amqp091-go/pull/350
- https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0
- https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv
FAQ
What is CVE-2026-77407?
CVE-2026-77407 is a documented vulnerability. RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN aut...
How severe is CVE-2026-77407?
CVSS scoring is not yet available for CVE-2026-77407. Check NVD for updates.
Is there a patch for CVE-2026-77407?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.