Bug 2535487 (CVE-2026-77407)

Summary: CVE-2026-77407 github.com/rabbitmq/amqp091-go: RabbitMQ amqp091-go: Plaintext Credential Exposure via Exported PLAIN Authentication Fields
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aazores, cmah, dhanak, doconnor, drosa, dsimansk, eaguilar, ebaron, eglynn, gparvin, jbalunas, jjoyce, jmatsuok, jpretori, jschluet, jtolenti, kingland, lhh, mburns, mgarciac, mnovotny, pjindal, rhaigner, sausingh, tsze
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in RabbitMQ amqp091-go, a Go client for AMQP 0.9.1. This vulnerability allows plaintext credentials to be exposed. After a successful PLAIN authentication handshake, the client retains passwords in an unencrypted format within its connection configuration. Local code with access to the connection object, such as logging or debugging tools, can access these sensitive credentials, leading to information disclosure. The credentials remain exposed for the entire duration of the connection.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2535979, 2535980    
Bug Blocks:    

Description OSIDB Bzimport 2026-09-16 14:52:02 UTC 
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.