CVE-2026-77404
RabbitMQ amqp091-go client writes TLS file paths into amqps URIs without encoding
Technology
RabbitMQ
CVSS Score
8.7 / 10.0
Affected Versions
amqp091-go before 1.13.0
Upstream Fix
amqp091-go 1.13.0
Published
September 16, 2026
OSSeva Coverage
Fixed upstream
Description
URI.String concatenates CertFile, KeyFile, CACertFile and ServerName into the query string without URL encoding. If an application accepts a path containing & or = and later reparses the URI, the delimiters can add or overwrite connection options, including which certificate, key or CA files are used.
Is your RabbitMQ deployment affected?
If you're running amqp091-go before 1.13.0, you need this patch. Book a discovery call to get covered.
Get a quote
Running RabbitMQ amqp091-go before 1.13.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?