Skip to content
OpenAdvisories
High · 7.0 CVE-2026-77407 EUVD-2026-80805GHSA-27gv-rfvv-22mvGO-2026-6491

RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields

Published Sep 16, 2026 · Updated Sep 16, 2026 · Assigned by GitHub_M

Description

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.

Affected products

VendorProductAffectedFixed
rabbitmq amqp091-go < 1.13.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 golang-github-rabbitmq-amqp091-go 1.14.0-1 —
Debian 13 golang-github-rabbitmq-amqp091-go No fix yet —
Debian 12 golang-github-rabbitmq-amqp091-go No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu 26.10 golang-github-rabbitmq-amqp091-go No fix yet —
Ubuntu 26.04 LTS golang-github-rabbitmq-amqp091-go No fix yet —
Ubuntu 24.04 LTS golang-github-rabbitmq-amqp091-go No fix yet —
ReleasePackageFixed inAdvisory
Red Hat Hardened Images 1 opentelemetry-collector-contrib 0.161.0-0.1.hum1 RHSA-2026:68290

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 keda No fix yet —
Azure Linux 3 telegraf 1.31.0-34 —

Affected packages

EcosystemPackageAffectedFixedRecord
Go github.com/rabbitmq/amqp091-go < 1.13.0 1.13.0 GHSA-27gv-rfvv-22mv

Advisories 1

References