CVE-2026-77407

Name of the Vulnerable Software and Affected Versions RabbitMQ amqp091-go versions prior to 1.13.0

Description An information disclosure issue exists where PlainAuth values retain passwords as exported plaintext fields within Connection.Config.SASL after a successful PLAIN authentication handshake. This occurs because the Connection.openComplete() function in connection.go fails to clear these values, leaving credentials available in-memory for the entire lifetime of the connection. Any code with access to the Connection object—such as reflective loggers, application performance monitoring (APM) agents, debugging utilities, or panic handlers—can traverse the configuration and expose the raw Username and Password variables to logs or state captures. This can lead to credentials being leaked into logging pipelines, SIEM systems, or standard output, where they may be accessed by unauthorized operators.

Recommendations Update RabbitMQ amqp091-go to version 1.13.0.