Vulnerability-Lookup

CVE-2026-77407 (GCVE-0-2026-77407)

Vulnerability from cvelistv5 – Published: 2026-09-16 14:34 – Updated: 2026-09-16 14:59

Title

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

Summary

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.

Severity

7 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 14:59 UTC

CWE

CWE-316 - Cleartext Storage of Sensitive Information in Memory

Assigner

GitHub_M mitre root

References

4 references

URL	Tags
https://github.com/rabbitmq/amqp091-go/security/a…	x_refsource_CONFIRM
https://github.com/rabbitmq/amqp091-go/pull/350	x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/commit/fa0…	x_refsource_MISC
https://github.com/rabbitmq/amqp091-go/releases/t…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
rabbitmq	amqp091-go	Affected: < 1.13.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77407",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T14:59:48.704679Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T14:59:54.889Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "amqp091-go",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "LOW",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "LOW",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-316",
              "description": "CWE-316: Cleartext Storage of Sensitive Information in Memory",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-16T14:34:18.876Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/pull/350",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/pull/350"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f"
        },
        {
          "name": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
        }
      ],
      "source": {
        "advisory": "GHSA-27gv-rfvv-22mv",
        "discovery": "UNKNOWN"
      },
      "title": "RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-77407",
    "datePublished": "2026-09-16T14:34:18.876Z",
    "dateReserved": "2026-08-20T19:55:27.023Z",
    "dateUpdated": "2026-09-16T14:59:54.889Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-77407",
      "date": "2026-09-17",
      "epss": "0.00127",
      "percentile": "0.02712"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-77407\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-09-16T15:17:49.210\",\"lastModified\":\"2026-09-16T15:17:49.210\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"rabbitmq\",\"product\":\"amqp091-go\",\"versions\":[{\"version\":\"\u003c 1.13.0\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":7.0,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"HIGH\",\"subIntegrityImpact\":\"LOW\",\"subAvailabilityImpact\":\"LOW\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-16T14:59:48.704679Z\",\"id\":\"CVE-2026-77407\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-316\"}]}],\"references\":[{\"url\":\"https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/rabbitmq/amqp091-go/pull/350\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv\",\"source\":\"security-advisories@github.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-17T20:12:15+00:00",
      "cve": "CVE-2026-77407",
      "id": "CVE-2026-77407",
      "initial_release_date": "2026-09-16T14:34:18.876000+00:00",
      "product_status:known_affected": "10",
      "product_status:known_not_affected": "4",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Fields",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-77407.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-17T16:59:07Z",
      "cve": "CVE-2026-77407",
      "id": "CVE-2026-77407",
      "initial_release_date": "2026-09-17T16:59:07Z",
      "product_status:known_affected": "9",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-77407",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-77407.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-316\", \"lang\": \"en\", \"description\": \"CWE-316: Cleartext Storage of Sensitive Information in Memory\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV4_0\": {\"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"HIGH\", \"subIntegrityImpact\": \"LOW\", \"subAvailabilityImpact\": \"LOW\", \"baseScore\": 7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L\", \"version\": \"4.0\"}}], \"references\": [{\"name\": \"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv\"}, {\"name\": \"https://github.com/rabbitmq/amqp091-go/pull/350\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/rabbitmq/amqp091-go/pull/350\"}, {\"name\": \"https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f\"}, {\"name\": \"https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0\"}], \"affected\": [{\"vendor\": \"rabbitmq\", \"product\": \"amqp091-go\", \"versions\": [{\"version\": \"\u003c 1.13.0\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-09-16T14:34:18.876Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.\"}], \"source\": {\"advisory\": \"GHSA-27gv-rfvv-22mv\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-77407\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-16T14:59:48.704679Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-16T14:59:51.337Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-77407\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-08-20T19:55:27.023Z\", \"datePublished\": \"2026-09-16T14:34:18.876Z\", \"dateUpdated\": \"2026-09-16T14:59:54.889Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-77407

Vulnerability from fkie_nvd - Published: 2026-09-16 15:17 - Updated: 2026-09-16 15:17

Severity

7.0 (High) - CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/pull/350
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0
	security-advisories@github.com	https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "amqp091-go",
          "vendor": "rabbitmq",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.13.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0."
    }
  ],
  "id": "CVE-2026-77407",
  "lastModified": "2026-09-16T15:17:49.210",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 7.0,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "LOW",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "LOW",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-77407",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T14:59:48.704679Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-16T15:17:49.210",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/pull/350"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-316"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-27GV-RFVV-22MV

Vulnerability from github – Published: 2026-09-17 17:04 – Updated: 2026-09-17 17:04

Summary

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

Details

Summary

An information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the Connection.Config.SASL field stores the Authentication implementation state used to establish the session.

For standard PLAIN authentication, this state utilizes the PlainAuth struct, which defines both Username and Password as publicly exported, plaintext string fields. Because this sensitive data is retained permanently in-memory within an exported field structure, any peripheral code, internal package, reflective logger, dependency, or automated debugging utility with access to the core *Connection object can read and expose the raw credentials.

Vulnerability Details

Mechanism

The vulnerability stems from the structural design of the configuration storage used during and after the AMQP handshake:

// auth.go:21-23
type PlainAuth struct {
    Username string
    Password string  // exported plaintext
}

When an application initializes a connection, the PlainAuth object is deeply nested inside the configuration structure (Connection.Config). Even after the handshake concludes and authentication is complete, this structure persists natively in-memory for the duration of the network connection's lifecycle.

Because Password is an exported string field, standard automated inspection mechanisms can read its value without restriction.

Affected Code Paths & Integrations

Any sub-component or library that traverses or reads the *Connection object will inadvertently read the plaintext password, including: * Reflective Loggers: Structured logging frameworks that serialize nested configuration structs into JSON/Log formats. * APM & Performance Agents: Automated telemetry or Application Performance Monitoring tools that capture state snapshots. * Debugging & Panic Handlers: Mid-tier software or dump libraries designed to capture goroutine state or print deep struct hierarchies upon program errors or signals.

Impact

The credential remains vulnerable to leak paths into logging pipelines, log aggregators, security information and event management (SIEM) systems, or standard output. Once transmitted to external log infrastructure, these credentials become accessible to unprivileged operators or any actor with access to log archives.

Attack Vector

An attacker does not necessarily need direct remote code execution to exploit this flaw; instead, the vulnerability acts as a credential harvesting vector inside multi-tenant environments or via secondary log exposure:

Configuration Dump: An operator configures a standard reflective logger or third-party APM package to capture system state parameters, including the active AMQP *Connection object.
Reflective Access: The inspection engine uses Go's reflect package to walk the structural hierarchy, pulling the string value from Connection.Config.SASL.(*PlainAuth).Password.
Exfiltration: The plaintext password is written to standard system logs, which are then scraped into shared logging aggregators, exposing production infrastructure credentials to a wider audience.

Severity

7.0 (High)


                  
                    CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/rabbitmq/amqp091-go"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-77407"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-316"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T17:04:10Z",
    "nvd_published_at": "2026-09-16T15:17:49Z",
    "severity": "HIGH"
  },
  "details": "## Summary\nAn information disclosure vulnerability exists in the AMQP client implementation\u0027s authentication handling configuration. Following a successful connection handshake, the `Connection.Config.SASL` field stores the `Authentication` implementation state used to establish the session. \n\nFor standard `PLAIN` authentication, this state utilizes the `PlainAuth` struct, which defines both `Username` and `Password` as publicly exported, plaintext string fields. Because this sensitive data is retained permanently in-memory within an exported field structure, any peripheral code, internal package, reflective logger, dependency, or automated debugging utility with access to the core `*Connection` object can read and expose the raw credentials.\n\n---\n\n## Vulnerability Details\n\n### Mechanism\nThe vulnerability stems from the structural design of the configuration storage used during and after the AMQP handshake:\n\n```go\n// auth.go:21-23\ntype PlainAuth struct {\n    Username string\n    Password string  // exported plaintext\n}\n```\n\nWhen an application initializes a connection, the `PlainAuth` object is deeply nested inside the configuration structure (`Connection.Config`). Even after the handshake concludes and authentication is complete, this structure persists natively in-memory for the duration of the network connection\u0027s lifecycle. \n\nBecause `Password` is an exported string field, standard automated inspection mechanisms can read its value without restriction.\n\n### Affected Code Paths \u0026 Integrations\nAny sub-component or library that traverses or reads the `*Connection` object will inadvertently read the plaintext password, including:\n* **Reflective Loggers:** Structured logging frameworks that serialize nested configuration structs into JSON/Log formats.\n* **APM \u0026 Performance Agents:** Automated telemetry or Application Performance Monitoring tools that capture state snapshots.\n* **Debugging \u0026 Panic Handlers:** Mid-tier software or dump libraries designed to capture goroutine state or print deep struct hierarchies upon program errors or signals.\n\n### Impact\nThe credential remains vulnerable to leak paths into logging pipelines, log aggregators, security information and event management (SIEM) systems, or standard output. Once transmitted to external log infrastructure, these credentials become accessible to unprivileged operators or any actor with access to log archives.\n\n---\n\n## Attack Vector\nAn attacker does not necessarily need direct remote code execution to exploit this flaw; instead, the vulnerability acts as a credential harvesting vector inside multi-tenant environments or via secondary log exposure:\n\n1. **Configuration Dump:** An operator configures a standard reflective logger or third-party APM package to capture system state parameters, including the active AMQP `*Connection` object.\n2. **Reflective Access:** The inspection engine uses Go\u0027s `reflect` package to walk the structural hierarchy, pulling the string value from `Connection.Config.SASL.(*PlainAuth).Password`.\n3. **Exfiltration:** The plaintext password is written to standard system logs, which are then scraped into shared logging aggregators, exposing production infrastructure credentials to a wider audience.",
  "id": "GHSA-27gv-rfvv-22mv",
  "modified": "2026-09-17T17:04:10Z",
  "published": "2026-09-17T17:04:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77407"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/pull/350"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/rabbitmq/amqp091-go"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L",
      "type": "CVSS_V4"
    }
  ],
  "summary": "RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-77407 (GCVE-0-2026-77407)

FKIE_CVE-2026-77407

GHSA-27GV-RFVV-22MV

Summary

Vulnerability Details

Mechanism

Affected Code Paths & Integrations

Impact

Attack Vector

Tags

Sightings

Nomenclature

Related by attack behaviour