Live › vulnerability › CVE-2026-77407
Go to dashboardThe amqp091-go Go client for RabbitMQ keeps the PLAIN authentication password in plaintext in an exported config field after connecting. Anyone or any tool that can read the Connection object, such as reflective loggers, APM agents, or panic dumps, can recover the RabbitMQ password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:13 UTC, 0h before NVD. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| github.com/rabbitmq/amqp091-go | go | < 1.13.0 | 1.13.0 |
Run go list -m github.com/rabbitmq/amqp091-go and check whether the version is below 1.13.0.
Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later, then rotate RabbitMQ credentials that were used by affected builds if logs or dumps could have captured them.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.
This page as .md · .json · in your agent: get_signal("CVE-2026-77407")
Go Vulnerability Database, CC-BY 4.0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.