CVE-2026-77407: RabbitMQ amqp091-go Plaintext Credential Exposure Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-27gv-rfvv-22mv",
  "modified" : "2026-09-17T17:04:10Z",
  "published" : "2026-09-17T17:04:10Z",
  "aliases" : [ "CVE-2026-77407" ],
  "summary" : "RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Struct Fields",
  "details" : "## Summary\nAn information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the `Connection.Config.SASL` field stores the `Authentication` implementation state used to establish the session. \n\nFor standard `PLAIN` authentication, this state utilizes the `PlainAuth` struct, which defines both `Username` and `Password` as publicly exported, plaintext string fields. Because this sensitive data is retained permanently in-memory within an exported field structure, any peripheral code, internal package, reflective logger, dependency, or automated debugging utility with access to the core `*Connection` object can read and expose the raw credentials.\n\n---\n\n## Vulnerability Details\n\n### Mechanism\nThe vulnerability stems from the structural design of the configuration storage used during and after the AMQP handshake:\n\n```go\n// auth.go:21-23\ntype PlainAuth struct {\n    Username string\n    Password string  // exported plaintext\n}\n```\n\nWhen an application initializes a connection, the `PlainAuth` object is deeply nested inside the configuration structure (`Connection.Config`). Even after the handshake concludes and authentication is complete, this structure persists natively in-memory for the duration of the network connection's lifecycle. \n\nBecause `Password` is an exported string field, standard automated inspection mechanisms can read its value without restriction.\n\n### Affected Code Paths & Integrations\nAny sub-component or library that traverses or reads the `*Connection` object will inadvertently read the plaintext password, including:\n* **Reflective Loggers:** Structured logging frameworks that serialize nested configuration structs into JSON/Log formats.\n* **APM & Performance Agents:** Automated telemetry or Application Performance Monitoring tools that capture state snapshots.\n* **Debugging & Panic Handlers:** Mid-tier software or dump libraries designed to capture goroutine state or print deep struct hierarchies upon program errors or signals.\n\n### Impact\nThe credential remains vulnerable to leak paths into logging pipelines, log aggregators, security information and event management (SIEM) systems, or standard output. Once transmitted to external log infrastructure, these credentials become accessible to unprivileged operators or any actor with access to log archives.\n\n---\n\n## Attack Vector\nAn attacker does not necessarily need direct remote code execution to exploit this flaw; instead, the vulnerability acts as a credential harvesting vector inside multi-tenant environments or via secondary log exposure:\n\n1. **Configuration Dump:** An operator configures a standard reflective logger or third-party APM package to capture system state parameters, including the active AMQP `*Connection` object.\n2. **Reflective Access:** The inspection engine uses Go's `reflect` package to walk the structural hierarchy, pulling the string value from `Connection.Config.SASL.(*PlainAuth).Password`.\n3. **Exfiltration:** The plaintext password is written to standard system logs, which are then scraped into shared logging aggregators, exposing production infrastructure credentials to a wider audience.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/rabbitmq/amqp091-go"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.13.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-77407"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rabbitmq/amqp091-go/pull/350"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/rabbitmq/amqp091-go"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-316" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-17T17:04:10Z",
    "nvd_published_at" : "2026-09-16T15:17:49Z"
  }
}