--- id: "CVE-2026-106123" kind: "vulnerability" aliases: ["CVE-2026-106123", "GHSA-h6w7-qmcm-q6xr"] title: "RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()" severity: "medium" cvss: 5.7 epss: 0.0015800000401213765 exploited: false status: "open" category: "package" products: [{"name": "com.rabbitmq:amqp-client", "fixed": ["5.35.0"], "affected": "<= 5.34.0", "ecosystem": "maven"}, {"name": "vmware rabbitmq java client", "fixed": ["5.35.0"], "affected": "< 5.35.0", "ecosystem": "vendor"}] ecosystems: ["maven", "vendor"] tags: ["cwe-209", "java", "maven", "package", "rabbitmq", "spring-boot"] not_affected_if: ["amqp-client-above-5.34.0", "uri-not-used-for-config"] published_at: "2026-10-06T19:17:43+00:00" first_seen_at: "2026-10-23T19:11:32+00:00" updated_at: "2026-10-23T23:44:52+00:00" sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-h6w7-qmcm-q6xr", "first_seen_at": "2026-10-23T19:11:32+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-106123", "first_seen_at": "2026-10-23T23:44:52+00:00"}] --- # RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() The RabbitMQ Java client (amqp-client) puts the full AMQP connection string, including the plaintext broker username and password, into an exception message when a uri config key fails to parse. Anyone who can read startup logs, error trackers, CI logs or pasted stack traces can recover the broker credentials. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - maven:com.rabbitmq:amqp-client affected <= 5.34.0 fixed 5.35.0 - vendor:vmware rabbitmq java client affected < 5.35.0 fixed 5.35.0 ## How to check Check whether the project depends on com.rabbitmq:amqp-client at 5.34.0 or earlier, e.g. with mvn dependency:tree | grep amqp-client or by reading pom.xml/build.gradle. If it does, look for ConnectionFactoryConfigurator.load or ConnectionFactory.load called with a uri key taken from properties or Spring config. ## Fix Upgrade com.rabbitmq:amqp-client to 5.35.0 or later. Until then, rotate the broker password of any account whose URI was logged and scrub existing logs and tickets that contain it. ## Timeline - 2026-10-23T19:11:32+00:00 ghsa https://github.com/advisories/GHSA-h6w7-qmcm-q6xr - 2026-10-23T23:44:52+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-106123 ## From the sources ### Summary When property-file/Map-based `ConnectionFactory` setup fails while parsing the `uri` key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception's message. ### Details `ConnectionFactoryConfigurator.load(ConnectionFactory, Map, String)` (`src/main/java/com/rabbitmq/client/ConnectionFactoryConfigurator.java`, lines 142-155): String uri = properties.get(prefix + "uri"); if (uri != null) { try { cf.setUri(uri); } catch (URISyntaxException e) { throw new IllegalArgumentException("Error while setting AMQP URI: " + uri, e); } catch (NoSuchAlgorithmException e) { throw new IllegalArgumentException("Error while setting AMQP URI: " + uri, e); } catch (KeyManagementException e) { throw new IllegalArgumentException("Error while setting AMQP URI: " + uri, e); } } `uri` is the full AMQP URI — `amqp(s)://username:password@host:port/vhost` — concatenated verbatim into the exception message on any of the three catch branches. No masking/redaction exists anywhere in this class or in `ConnectionFactory.setUri()`. This is the library's documented Spring-Boot/ops-config entry point (`ConnectionFactory.load(...)`, available since 4.4.0), not obscure internal code. RabbitMQ's own AMQP URI spec (rabbitmq.com/docs/uri-spec) explicitly warns the password "should avoid leaking... the full URI should not appear in exception messages or log records." A sibling method twenty lines away (`ConnectionFactory.setUri(URI)`) already avoids this exact mistake for a different malformed-URI case — this path wasn't caught by that same care. Note: `KeyManagementException` is declared in the throws clause but not actually reachable via the current `setUri(String)` → `setUri(URI)` call chain — the two real, reachable leak surfaces are the `URISyntaxException` branch (trivial, deterministic, scheme-independent) and the `NoSuchAlgorithmException` branch (real but narrower — `amqps://` only, requires a restricted/FIPS-style default TLS provider). ### PoC Map props = new HashMap<>(); props.put("uri", "amqp://svc-account:P@ssW0rd With Space!@broker.internal:5672/prod"); ConnectionFactory cf = new ConnectionFactory(); ConnectionFactoryConfigurator.load(cf, props, ""); Throws: java.lang.IllegalArgumentException: Error while setting AMQP URI: amqp://svc-account:P@ssW0rd With Space!@broker.internal:5672/prod A password containing a space is entirely ordinary under common corporate password policies, and `java.net.URI` rejects such input outright — this isn't a contrived edge case. ### Impact Default Spring Boot startup-failure logging, an APM/error tracker, a CI job log, or an engineer pasting a stack trace into an internal or public ticket now holds the plaintext broker password, in a system typically far less access-controlled than wherever the credential is normally stored. Note the underlying `URISyntaxException` also carries the same string in its own message, chained as the cause of RabbitMQ's `IllegalArgumentException` — so removing RabbitMQ's own `+ uri` concatenation alone would not fully close this; the raw secret-bearing string also shouldn't be handed to `new URI()` for error-reporting purposes at all. Suggested fix: don't include the raw `uri` string in the wrapped exception's message — redact the userinfo component (or omit the URI entirely) before including it in any exception text. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_