GHSA-27GV-RFVV-22MV
Vulnerability from github – Published: 2026-09-17 17:04 – Updated: 2026-09-17 17:04Summary
An information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the Connection.Config.SASL field stores the Authentication implementation state used to establish the session.
For standard PLAIN authentication, this state utilizes the PlainAuth struct, which defines both Username and Password as publicly exported, plaintext string fields. Because this sensitive data is retained permanently in-memory within an exported field structure, any peripheral code, internal package, reflective logger, dependency, or automated debugging utility with access to the core *Connection object can read and expose the raw credentials.
Vulnerability Details
Mechanism
The vulnerability stems from the structural design of the configuration storage used during and after the AMQP handshake:
// auth.go:21-23
type PlainAuth struct {
Username string
Password string // exported plaintext
}
When an application initializes a connection, the PlainAuth object is deeply nested inside the configuration structure (Connection.Config). Even after the handshake concludes and authentication is complete, this structure persists natively in-memory for the duration of the network connection's lifecycle.
Because Password is an exported string field, standard automated inspection mechanisms can read its value without restriction.
Affected Code Paths & Integrations
Any sub-component or library that traverses or reads the *Connection object will inadvertently read the plaintext password, including:
* Reflective Loggers: Structured logging frameworks that serialize nested configuration structs into JSON/Log formats.
* APM & Performance Agents: Automated telemetry or Application Performance Monitoring tools that capture state snapshots.
* Debugging & Panic Handlers: Mid-tier software or dump libraries designed to capture goroutine state or print deep struct hierarchies upon program errors or signals.
Impact
The credential remains vulnerable to leak paths into logging pipelines, log aggregators, security information and event management (SIEM) systems, or standard output. Once transmitted to external log infrastructure, these credentials become accessible to unprivileged operators or any actor with access to log archives.
Attack Vector
An attacker does not necessarily need direct remote code execution to exploit this flaw; instead, the vulnerability acts as a credential harvesting vector inside multi-tenant environments or via secondary log exposure:
- Configuration Dump: An operator configures a standard reflective logger or third-party APM package to capture system state parameters, including the active AMQP
*Connectionobject. - Reflective Access: The inspection engine uses Go's
reflectpackage to walk the structural hierarchy, pulling the string value fromConnection.Config.SASL.(*PlainAuth).Password. - Exfiltration: The plaintext password is written to standard system logs, which are then scraped into shared logging aggregators, exposing production infrastructure credentials to a wider audience.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/rabbitmq/amqp091-go"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-77407"
],
"database_specific": {
"cwe_ids": [
"CWE-316"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-17T17:04:10Z",
"nvd_published_at": "2026-09-16T15:17:49Z",
"severity": "HIGH"
},
"details": "## Summary\nAn information disclosure vulnerability exists in the AMQP client implementation\u0027s authentication handling configuration. Following a successful connection handshake, the `Connection.Config.SASL` field stores the `Authentication` implementation state used to establish the session. \n\nFor standard `PLAIN` authentication, this state utilizes the `PlainAuth` struct, which defines both `Username` and `Password` as publicly exported, plaintext string fields. Because this sensitive data is retained permanently in-memory within an exported field structure, any peripheral code, internal package, reflective logger, dependency, or automated debugging utility with access to the core `*Connection` object can read and expose the raw credentials.\n\n---\n\n## Vulnerability Details\n\n### Mechanism\nThe vulnerability stems from the structural design of the configuration storage used during and after the AMQP handshake:\n\n```go\n// auth.go:21-23\ntype PlainAuth struct {\n Username string\n Password string // exported plaintext\n}\n```\n\nWhen an application initializes a connection, the `PlainAuth` object is deeply nested inside the configuration structure (`Connection.Config`). Even after the handshake concludes and authentication is complete, this structure persists natively in-memory for the duration of the network connection\u0027s lifecycle. \n\nBecause `Password` is an exported string field, standard automated inspection mechanisms can read its value without restriction.\n\n### Affected Code Paths \u0026 Integrations\nAny sub-component or library that traverses or reads the `*Connection` object will inadvertently read the plaintext password, including:\n* **Reflective Loggers:** Structured logging frameworks that serialize nested configuration structs into JSON/Log formats.\n* **APM \u0026 Performance Agents:** Automated telemetry or Application Performance Monitoring tools that capture state snapshots.\n* **Debugging \u0026 Panic Handlers:** Mid-tier software or dump libraries designed to capture goroutine state or print deep struct hierarchies upon program errors or signals.\n\n### Impact\nThe credential remains vulnerable to leak paths into logging pipelines, log aggregators, security information and event management (SIEM) systems, or standard output. Once transmitted to external log infrastructure, these credentials become accessible to unprivileged operators or any actor with access to log archives.\n\n---\n\n## Attack Vector\nAn attacker does not necessarily need direct remote code execution to exploit this flaw; instead, the vulnerability acts as a credential harvesting vector inside multi-tenant environments or via secondary log exposure:\n\n1. **Configuration Dump:** An operator configures a standard reflective logger or third-party APM package to capture system state parameters, including the active AMQP `*Connection` object.\n2. **Reflective Access:** The inspection engine uses Go\u0027s `reflect` package to walk the structural hierarchy, pulling the string value from `Connection.Config.SASL.(*PlainAuth).Password`.\n3. **Exfiltration:** The plaintext password is written to standard system logs, which are then scraped into shared logging aggregators, exposing production infrastructure credentials to a wider audience.",
"id": "GHSA-27gv-rfvv-22mv",
"modified": "2026-09-17T17:04:10Z",
"published": "2026-09-17T17:04:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77407"
},
{
"type": "WEB",
"url": "https://github.com/rabbitmq/amqp091-go/pull/350"
},
{
"type": "WEB",
"url": "https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f"
},
{
"type": "PACKAGE",
"url": "https://github.com/rabbitmq/amqp091-go"
},
{
"type": "WEB",
"url": "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L",
"type": "CVSS_V4"
}
],
"summary": "RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields"
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.