---
id: "CVE-2026-77407"
kind: "vulnerability"
aliases: ["CVE-2026-77407", "GHSA-27gv-rfvv-22mv", "GO-2026-6491"]
title: "RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields in github.com/rabbitmq/amqp091-go"
severity: "high"
cvss: 7.0
epss: 0.00128
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/rabbitmq/amqp091-go", "fixed": ["1.13.0"], "affected": "< 1.13.0", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["amqp", "go", "package", "rabbitmq"]
not_affected_if: ["non-go-stack", "unused-plain-auth"]
published_at: "2026-09-16T15:17:49+00:00"
first_seen_at: "2026-10-23T19:13:08+00:00"
updated_at: "2026-10-23T21:45:56+00:00"
sources: [{"source": "govuln", "url": "https://pkg.go.dev/vuln/GO-2026-6491", "first_seen_at": "2026-10-23T19:13:08+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-77407", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77407", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields in github.com/rabbitmq/amqp091-go

The amqp091-go Go client for RabbitMQ keeps the PLAIN authentication password in plaintext in an exported config field after connecting. Anyone or any tool that can read the Connection object, such as reflective loggers, APM agents, or panic dumps, can recover the RabbitMQ password.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/rabbitmq/amqp091-go affected < 1.13.0 fixed 1.13.0

## How to check

Run `go list -m github.com/rabbitmq/amqp091-go` and check whether the version is below 1.13.0.

## Fix

Upgrade github.com/rabbitmq/amqp091-go to 1.13.0 or later, then rotate RabbitMQ credentials that were used by affected builds if logs or dumps could have captured them.

## Timeline

- 2026-10-23T19:13:08+00:00 govuln https://pkg.go.dev/vuln/GO-2026-6491
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-77407
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77407

## From the sources

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_