CVE-2026-77407
RabbitMQ amqp091-go client keeps the PLAIN password in the connection config for the connection's lifetime
Technology
RabbitMQ
CVSS Score
7.0 / 10.0
Affected Versions
amqp091-go before 1.13.0
Upstream Fix
amqp091-go 1.13.0
Published
September 16, 2026
OSSeva Coverage
Fixed upstream
Description
After PLAIN authentication, the password stays in an exported field of Connection.Config.SASL and is never cleared. Anything that walks the connection object, such as reflective loggers, APM agents, debuggers or panic handlers, can write the credential to logs or state dumps.
Is your RabbitMQ deployment affected?
If you're running amqp091-go before 1.13.0, you need this patch. Book a discovery call to get covered.
Get a quote
Running RabbitMQ amqp091-go before 1.13.0?
Send your work email and a senior engineer will tell you whether this CVE applies to your versions and who patches it. Reply within 1 business day.
Prefer to talk or read more first?