CVE-2026-77407

The official Go AMQP 0.9.1 client for RabbitMQ (amqp091-go) fails to clear PlainAuth credentials after a successful PLAIN authentication handshake: Connection.openComplete in connection.go leaves exported plaintext username/password fields populated in Connection.Config.SASL for the lifetime of the connection. The flaw is triggered by any code that can access the live Connection object, such as reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, which can traverse the configuration and dump the credentials into logs or state captures. An attacker with local process access, or anyone who obtains such log output or crash dumps, gains the valid RabbitMQ username and password. All applications built with amqp091-go versions prior to 1.13.0 that authenticate with PLAIN are affected. No public proof-of-concept, listing in CISA KEV, or known in-the-wild exploitation has been reported; the vendor-assigned CVSS 4.0 score is 7.0 (high) with a local attack vector.

What to do: Upgrade amqp091-go to version 1.13.0 or later, which clears the credentials after authentication. As an interim mitigation, ensure loggers, APM agents, debug dumps, and panic handlers never serialize Connection.Config or its SASL fields, and audit existing logs and crash captures for exposed passwords. If sensitive logs or dumps may have retained credentials, rotate the affected RabbitMQ user credentials.