CVE-2026-77404: RabbitMQ amqp091-go Information Disclosure

CVE-2026-77404 Overview

CVE-2026-77404 affects the RabbitMQ amqp091-go client library, a Go implementation of the Advanced Message Queuing Protocol (AMQP) 0.9.1. Versions prior to 1.13.0 improperly serialize Transport Layer Security (TLS) configuration values into AMQPS Uniform Resource Identifier (URI) strings. The URI.String function in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into the query string without URL encoding. Attackers who control TLS asset paths can inject ampersand or equals delimiters to overwrite connection options when the serialized URI is later reparsed with ParseURI. The issue is fixed in version 1.13.0. This vulnerability is categorized under [CWE-116] Improper Encoding or Escaping of Output.

Critical Impact

Injection of URI query delimiters can overwrite TLS certificate, key, or CA file paths, redirecting AMQPS connections to unintended local cryptographic assets and corrupting connection configuration.

Affected Products

• RabbitMQ amqp091-go versions prior to 1.13.0
• Go applications embedding the amqp091-go AMQP 0.9.1 client
• Systems that accept externally influenced TLS file paths and reparse serialized AMQPS URIs

Discovery Timeline

• 2026-09-16 - CVE-2026-77404 published to the National Vulnerability Database (NVD)
• 2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77404

Vulnerability Analysis

The vulnerability resides in the URI.String method of uri.go in the amqp091-go client. When an amqp.URI structure contains any of the TLS-related fields CertFile, KeyFile, CACertFile, or ServerName, the method builds an AMQPS query string by direct string concatenation. Field values are inserted without escaping reserved URI query characters such as & and =. If an application later reparses the resulting URI with ParseURI, injected delimiters split the tainted value into multiple query parameters. This enables an attacker who controls a TLS asset path to introduce or overwrite certfile, keyfile, cacertfile, or server_name_indication parameters.

Root Cause

The root cause is the use of a strings.Builder to assemble raw query parameters rather than the url.Values type from the Go standard library. Direct concatenation bypasses percent-encoding of reserved characters. Because the AMQP 0.9.1 client trusts values on the round-trip through URI.String and ParseURI, structural delimiters embedded in a value are interpreted as syntax rather than data.

Attack Vector

Exploitation requires local access with low privileges and passive user interaction, consistent with the local attack vector described in the advisory. An attacker who influences a TLS asset path, for example through configuration input, environment variables, or a shared configuration store, can inject &keyfile=/path/to/attacker/key style payloads. When the application serializes the URI and later reparses it, the client selects the injected key, certificate, or CA file instead of the intended cryptographic material. The result is corrupted connection configuration or selection of unintended local cryptographic assets used to establish the AMQPS session.

// Security patch in uri.go - URL-encode TLS file paths in URI.String() query string
if uri.CertFile != "" || uri.KeyFile != "" || uri.CACertFile != "" || uri.ServerName != "" {
-    rawQuery := strings.Builder{}
+    q := url.Values{}
    if uri.CertFile != "" {
-        rawQuery.WriteString("certfile=")
-        rawQuery.WriteString(uri.CertFile)
-        rawQuery.WriteRune('&')
+        q.Set("certfile", uri.CertFile)
    }
    if uri.KeyFile != "" {
-        rawQuery.WriteString("keyfile=")
-        rawQuery.WriteString(uri.KeyFile)
-        rawQuery.WriteRune('&')
+        q.Set("keyfile", uri.KeyFile)
    }
    if uri.CACertFile != "" {
-        rawQuery.WriteString("cacertfile=")
-        rawQuery.WriteString(uri.CACertFile)
-        rawQuery.WriteRune('&')
+        q.Set("cacertfile", uri.CACertFile)
    }
    if uri.ServerName != "" {
-        rawQuery.WriteString("server_name_indication=")
-        rawQuery.WriteString(uri.ServerName)
+        q.Set("server_name_indication", uri.ServerName)
    }
-    authority.RawQuery = rawQuery.String()
+    authority.RawQuery = q.Encode()
}

Source: GitHub Commit 743d488. The patch replaces raw string concatenation with url.Values.Encode, which percent-encodes reserved query characters.

Detection Methods for CVE-2026-77404

Indicators of Compromise

• AMQPS connection URIs containing unexpected certfile, keyfile, cacertfile, or server_name_indication parameters not defined by the application configuration
• TLS handshakes using certificate or key files whose paths differ from the deployment's expected cryptographic asset directory
• Configuration values for TLS paths that contain literal & or = characters

Detection Strategies

• Perform dependency scanning of Go modules to identify github.com/rabbitmq/amqp091-go versions earlier than 1.13.0
• Review application code paths that accept external input into URI.CertFile, URI.KeyFile, URI.CACertFile, or URI.ServerName
• Statically inspect all call sites where URI.String output is later passed to ParseURI for potential round-trip injection

Monitoring Recommendations

• Log the fully resolved TLS file paths used by AMQP clients at connection establishment and alert on unexpected paths
• Monitor file access telemetry on hosts running RabbitMQ clients for reads of certificate and key files outside approved directories
• Track process execution and file access using endpoint telemetry to identify anomalous cryptographic asset selection

How to Mitigate CVE-2026-77404

Immediate Actions Required

• Upgrade github.com/rabbitmq/amqp091-go to version 1.13.0 or later and rebuild all dependent Go binaries
• Audit application inputs that populate URI.CertFile, URI.KeyFile, URI.CACertFile, and URI.ServerName for untrusted sources
• Restrict filesystem permissions on directories containing TLS certificates, keys, and CA bundles used by AMQP clients

Patch Information

The fix is released in amqp091-go v1.13.0. The patch modifies URI.String in uri.go to build the query string with url.Values and Encode, ensuring reserved characters in TLS path values are percent-encoded. Refer to the GitHub Security Advisory GHSA-465g-fh3v-9jw4, Pull Request #352, and the v1.13.0 Release Notes.

Workarounds

• Validate TLS path inputs and reject values containing &, =, ?, or # characters before assigning them to URI fields
• Avoid round-tripping URIs through URI.String and ParseURI; pass the structured amqp.URI value directly to the dialer where possible
• Store TLS asset paths as immutable deployment constants rather than reading them from user-supplied configuration

# Update the module to the fixed version
go get github.com/rabbitmq/amqp091-go@v1.13.0
go mod tidy
go build ./...