CVE-2026-77407: RabbitMQ amqp091-go Information Disclosure

CVE-2026-77407 Overview

CVE-2026-77407 is an information disclosure vulnerability in the RabbitMQ amqp091-go client library, a Go implementation of the Advanced Message Queuing Protocol (AMQP) 0.9.1. Prior to version 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful Simple Authentication and Security Layer (SASL) PLAIN handshake. The Connection.openComplete method in connection.go never clears those fields, leaving the credentials resident for the lifetime of the connection object. This weakness is tracked under CWE-316: Cleartext Storage of Sensitive Information in Memory.

Critical Impact
Any code with access to the Connection object, including reflective loggers, application performance monitoring (APM) agents, debuggers, and panic handlers, can traverse configuration state and leak broker credentials into logs or crash dumps.

Affected Products

RabbitMQ amqp091-go client library versions prior to 1.13.0
Go applications that establish AMQP 0.9.1 connections using PlainAuth
Services that emit stack traces, panic captures, or reflective log output from active RabbitMQ connections

Discovery Timeline

2026-09-16 - CVE-2026-77407 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-77407

Vulnerability Analysis

The amqp091-go client accepts authentication credentials through a PlainAuth struct that holds Username and Password as exported string fields. During connection setup, the client sends a PLAIN SASL response containing these credentials to the broker. After the handshake completes, the library retains the original PlainAuth instance inside Connection.Config.SASL for the remainder of the connection lifetime.

Because the fields are exported and never zeroed, any caller holding a reference to the amqp.Connection can reach conn.Config.SASL and read the password directly. Common Go tooling that walks struct state through reflect or fmt.Sprintf("%+v", ...) will render the password inline. This includes structured loggers, APM agents that serialize context objects, debugging middleware, and default panic handlers that print goroutine state.

Root Cause

The root cause is a design decision to keep authentication material in an exported, human-readable form beyond the point at which it is needed. The PlainAuth type had no custom String() method and no post-handshake cleanup path. As a result, sensitive material was treated as ordinary configuration and inherited the same visibility.

Attack Vector

Exploitation requires local access to the process memory or to any output stream that captures the Connection object. An attacker who can read application logs, crash artifacts, APM traces, or debug endpoints can extract the broker password without interacting with the network. The scope extends to any downstream system that ingests those artifacts, which is why the vulnerability carries a HIGH rating despite a local attack vector.

// Patch excerpt from auth.go: PlainAuth now redacts its string representation
 	Password string
 }

+// String returns a redacted representation of PlainAuth.
+func (auth PlainAuth) String() string {
+	return fmt.Sprintf("PlainAuth{Username: %q, Password: [REDACTED]}", auth.Username)
+}
+
 // Mechanism returns "PLAIN"
 func (auth *PlainAuth) Mechanism() string {
 	return "PLAIN"
// Source: https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f

The patch adds a custom String() method so that formatters and reflective loggers emit [REDACTED] instead of the actual password. A companion change in connection.go refactors SASL population to align with the new lifecycle:

// Patch excerpt from connection.go: setSASL now centralizes SASL configuration
+// setSASL populates the SASL configuration from URI if it's not already set.
+func (config *Config) setSASL(uri URI) error {
+	if config.SASL == nil {
+		if uri.AuthMechanism != nil {
+			for _, identifier := range uri.AuthMechanism {
+				switch strings.ToUpper(identifier) {
+				case "PLAIN":
+					config.SASL = append(config.SASL, uri.PlainAuth())
+				case "AMQPLAIN":
+					config.SASL = append(config.SASL, uri.AMQPlainAuth())
+				case "EXTERNAL":
+					config.SASL = append(config.SASL, &ExternalAuth{})
+				default:
+					return fmt.Errorf("unsupported auth_mechanism: %v", identifier)
+				}
+			}
+		} else {
+			config.SASL = []Authentication{uri.PlainAuth()}
+		}
+	}
+	return nil
+}
// Source: https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f

Detection Methods for CVE-2026-77407

Indicators of Compromise

Log entries containing PlainAuth{Username: followed by a plaintext Password: field rather than [REDACTED]
Panic traces or crash dumps that include serialized amqp.Config or amqp.Connection structures with populated SASL slices
APM span attributes or trace payloads that include AMQP connection configuration objects

Detection Strategies

Search source repositories for use of github.com/rabbitmq/amqp091-go at versions below 1.13.0 and flag any go.mod or go.sum entries that pin vulnerable releases.
Grep production log stores for AMQP connection strings, amqp.Config dumps, or the literal token PlainAuth{ to identify historical credential exposure.
Run software composition analysis (SCA) tooling as part of continuous integration to detect the vulnerable dependency on every build.

Monitoring Recommendations

Alert when application logs or crash artifacts contain AMQP URIs of the form amqp://user:password@host after the client library upgrade.
Monitor APM and observability platforms for context payloads that include RabbitMQ configuration structures.
Track outbound authentication failures on the RabbitMQ broker to detect credential rotation lag after suspected exposure.

How to Mitigate CVE-2026-77407

Immediate Actions Required

Upgrade github.com/rabbitmq/amqp091-go to version 1.13.0 or later across all Go services that connect to RabbitMQ.
Rotate every RabbitMQ user password whose credentials may have been serialized into logs, crash captures, or APM traces by vulnerable clients.
Purge historical log and trace data that contains AMQP connection dumps, or restrict access to those stores until sanitization completes.

Patch Information

The fix is delivered in amqp091-go release v1.13.0 via pull request #350. Full technical background is documented in GitHub Security Advisory GHSA-27gv-rfvv-22mv.

Workarounds

Replace direct use of PlainAuth with a custom Authentication implementation that overrides String() to redact credentials, if immediate upgrade is not possible.
Disable verbose or reflective logging of connection objects, and configure structured loggers to omit Config and SASL fields.
Restrict access to application log stores, panic captures, and APM trace repositories to reduce the exposure surface for retained credentials.

bash

# Upgrade the amqp091-go dependency in a Go project
go get github.com/rabbitmq/amqp091-go@v1.13.0
go mod tidy

# Verify the resolved version
go list -m github.com/rabbitmq/amqp091-go