{"id":"CVE-2026-77407","kind":"vulnerability","aliases":["CVE-2026-77407","GHSA-27gv-rfvv-22mv","GO-2026-6491"],"related":[],"title":"RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields in github.com/rabbitmq/amqp091-go","description":"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.","summary":"The amqp091-go Go client for RabbitMQ keeps the PLAIN authentication password in plaintext in an exported config field after connecting. Anyone or any tool that can read the Connection object, such as reflective loggers, APM agents, or panic dumps, can recover the RabbitMQ password.","severity":"high","cvss":7.0,"epss":0.00128,"exploited":false,"exploited_at":null,"products":[{"name":"github.com/rabbitmq/amqp091-go","fixed":["1.13.0"],"affected":"< 1.13.0","ecosystem":"go"}],"ecosystems":["go"],"tags":["amqp","go","package","rabbitmq"],"not_affected_if":["non-go-stack","unused-plain-auth"],"how_to_check":"Run `go list -m github.com/rabbitmq/amqp091-go` and check whether the version is below 1.13.0.","fix":"Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later, then rotate RabbitMQ credentials that were used by affected builds if logs or dumps could have captured them.","status":"open","published_at":"2026-09-16T15:17:49+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","triaged_at":"2026-10-23T21:45:56+00:00","updated_at":"2026-10-23T21:45:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T21:45:56Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later, then rotate RabbitMQ credentials that were used by affected builds if logs or dumps could have captured them.","reach":"local","impact":"medium","summary":"The amqp091-go Go client for RabbitMQ keeps the PLAIN authentication password in plaintext in an exported config field after connecting. Anyone or any tool that can read the Connection object, such as reflective loggers, APM agents, or panic dumps, can recover the RabbitMQ password.","category":"package","who_cares":["go","rabbitmq","amqp"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker recovers RabbitMQ password from logs or memory dumps","analyst_note":"","how_to_check":"Run `go list -m github.com/rabbitmq/amqp091-go` and check whether the version is below 1.13.0.\nunknown\nunknown","needs_analyst":false,"not_affected_if":["unused-plain-auth","non-go-stack"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.00051,"input_tokens":3076,"output_tokens":405,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':19A,27A,30A '-6491':28A '-77407':20A,31A '/rabbitmq/amqp091-go':17A,34A '0.9.1':93C '1.13.0':97C,181C '22mv':25A '27gv':23A 'access':129C 'agent':76B,140C 'amqp':35B,92C 'amqp091':3A,41B,87C 'amqp091-go':2A,40B,86C 'anyon':61B 'apm':75B 'applic':137C 'auth.go':102C 'authent':11A,50B,115C,174C 'avail':162C 'captur':158C 'clear':124C,172C 'client':44B,94C 'code':127C 'config':57B 'configur':149C 'connect':60B,69B,132C,168C 'connection.config.sasl':110C 'connection.go':121C 'connection.opencomplete':118C 'credenti':6A,153C,160C 'cve':18A,29A 'debug':141C 'defin':100C 'dump':79B 'export':9A,56B,106C 'expos':151C 'exposur':7A 'field':13A,58B,108C 'fix':178C 'ghsa':22A 'ghsa-27gv-rfvv-22mv':21A 'github.com':16A,33A 'github.com/rabbitmq/amqp091-go':15A,32A 'go':4A,26A,36B,42B,43B,88C,91C 'handler':145C 'handshak':116C 'includ':134C 'instead':169C 'issu':176C 'keep':47B 'lifetim':165C 'log':155C 'logger':74B,136C 'method':119C 'monitor':139C 'object':70B,133C 'packag':37B 'panic':78B,144C 'password':51B,84B,104C 'perform':138C 'plain':10A,49B,114C 'plainauth':98C 'plaintext':5A,53B,107C 'prior':95C 'rabbitmq':1A,38B,46B,83B,85C 'read':67B 'recov':81B 'reflect':73B,135C 'remain':161C 'retain':103C 'rfvv':24A 'state':157C 'struct':12A 'success':113C 'tool':64B 'travers':147C 'util':142C 'valu':99C,126C 'version':180C 'via':8A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T15:17:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"govuln","external_id":"GO-2026-6491","url":"https://pkg.go.dev/vuln/GO-2026-6491","severity":null,"published_at":"2026-10-01T20:23:56+00:00","modified_at":"2026-10-01T20:23:56+00:00","first_seen_at":"2026-10-23T19:13:08+00:00","fetched_at":"2026-10-23T19:13:08+00:00","note":null},{"source":"epss","external_id":"CVE-2026-77407","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77407","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:43+00:00","fetched_at":"2026-10-23T19:13:43+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-77407","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77407","severity":null,"published_at":"2026-09-16T15:17:49+00:00","modified_at":"2026-09-23T18:19:19+00:00","first_seen_at":"2026-10-23T19:35:23+00:00","fetched_at":"2026-10-23T19:35:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}