CVE-2026-77407 in amqp091-go
Summary
by MITRE • 09/17/2026
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in RabbitMQ amqp091-go versions prior to 1.13.0 represents a critical information disclosure flaw rooted in improper credential lifecycle management within the Go AMQP client library. The core technical issue lies in the handling of authentication data during and after the PLAIN SASL handshake process. Specifically, when PlainAuth values are defined in auth.go, they are stored as exported plaintext fields within Connection.Config.SASL upon successful authentication. Crucially, the connection.openComplete method fails to clear or zero out these sensitive credentials from memory once the authentication phase is concluded. This design oversight means that the password remains resident in the application's memory for the entire duration of the network connection rather than being securely erased immediately after use, creating a persistent window of opportunity for attackers to extract secrets through side-channel attacks or direct memory inspection.
The operational impact of this vulnerability is severe because it exposes credentials to any component within the Go runtime environment that has access to the Connection object. This includes not only application code but also third-party tools such as reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers. These systems often capture stack traces, variable states, or structured logs for diagnostic purposes. If these components traverse the configuration structure of an active connection, they can inadvertently serialize or print the plaintext password into log files, metrics databases, or crash dumps. This transforms a standard authentication mechanism into a significant data breach vector, as credentials that should remain confidential are rendered visible to system administrators, monitoring platforms, and potentially malicious actors who have gained access to these diagnostic artifacts.
From a classification perspective, this vulnerability aligns with CWE-259, which covers the use of passwords or keys in plaintext without encryption, specifically regarding storage and transmission flaws where sensitive data is retained longer than necessary. It also relates closely to CWE-312, concerning cleartext storage of sensitive information, as the credentials are kept in memory in an unencrypted format after their immediate utility has passed. In terms of adversarial tactics, this flaw facilitates credential harvesting techniques described in MITRE ATT&CK under Tactic TA0006 (Credential Access), specifically supporting methods like Steal Application Credentials or Unsecured Credentials where attackers exploit poorly managed sensitive data within applications to gain unauthorized access to backend systems and services protected by RabbitMQ.
To mitigate this risk, organizations must immediately upgrade the amqp091-go library to version 1.13.0 or later, which implements proper memory sanitization practices by clearing authentication fields after the handshake is complete. For environments where upgrading is not immediately feasible, developers should implement strict access controls on Connection objects to prevent reflective logging agents from inspecting internal configuration structures during active sessions. Additionally, integrating secret scanning tools into CI/CD pipelines can help detect accidental exposure of credentials in logs or dumps that may have already occurred due to this flaw. Regular rotation of RabbitMQ passwords is also recommended as a compensating control to limit the window of exploitation for any previously leaked credentials.