RabbitMQ amqp091-go up to 1.12.x Authentication connection.go Connection.openComplete PlainAuth missing encryption

Summaryinfo

A vulnerability classified as problematic has been found in RabbitMQ amqp091-go up to 1.12.x. Impacted is the function Connection.openComplete of the file connection.go of the component Authentication. The manipulation of the argument PlainAuth leads to missing encryption. This vulnerability is documented as CVE-2026-77407. The attack needs to be performed locally. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in RabbitMQ amqp091-go up to 1.12.x. It has been rated as problematic. This issue affects the function Connection.openComplete of the file connection.go of the component Authentication. The manipulation of the argument PlainAuth with an unknown input leads to a missing encryption vulnerability. Using CWE to declare the problem leads to CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. Impacted is confidentiality. The summary by CVE is:

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-77407 since 08/20/2026. The exploitation is known to be difficult. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1600 according to MITRE ATT&CK.

Upgrading to version 1.13.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• RabbitMQ

Name

• amqp091-go

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12

Website

• Product: https://github.com/rabbitmq/amqp091-go/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion