CVE-2026-77407: CWE-316: Cleartext Storage of Sensitive Information in Memory in rabbitmq amqp091-go
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.
AI Analysis
Technical Summary
RabbitMQ amqp091-go versions before 1.13.0 retain plaintext passwords in exported fields within the Connection.Config.SASL structure after PLAIN authentication. The method Connection.openComplete does not clear these sensitive values, allowing any code with access to the Connection object to potentially expose credentials through logs, monitoring agents, or debugging utilities. This cleartext storage of sensitive information in memory constitutes a CWE-316 vulnerability. The issue is resolved in version 1.13.0.
Potential Impact
Sensitive authentication credentials remain in cleartext in memory for the duration of the connection, increasing the risk of credential exposure through logs, monitoring tools, or debugging utilities that access the Connection object. This could lead to unauthorized access if an attacker or malicious code can access these credentials.
Mitigation Recommendations
Upgrade to RabbitMQ amqp091-go version 1.13.0 or later, where the vulnerability is fixed by clearing sensitive authentication data after use. No other mitigations are indicated.
CVE-2026-77407: CWE-316: Cleartext Storage of Sensitive Information in Memory in rabbitmq amqp091-go
Description
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.
CVSS v4.0
Score 7.0high
Affected software
rabbitmq
amqp091-go
pkg:golang/github.com/rabbitmq/amqp091-goRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RabbitMQ amqp091-go versions before 1.13.0 retain plaintext passwords in exported fields within the Connection.Config.SASL structure after PLAIN authentication. The method Connection.openComplete does not clear these sensitive values, allowing any code with access to the Connection object to potentially expose credentials through logs, monitoring agents, or debugging utilities. This cleartext storage of sensitive information in memory constitutes a CWE-316 vulnerability. The issue is resolved in version 1.13.0.
Potential Impact
Sensitive authentication credentials remain in cleartext in memory for the duration of the connection, increasing the risk of credential exposure through logs, monitoring tools, or debugging utilities that access the Connection object. This could lead to unauthorized access if an attacker or malicious code can access these credentials.
Mitigation Recommendations
Upgrade to RabbitMQ amqp091-go version 1.13.0 or later, where the vulnerability is fixed by clearing sensitive authentication data after use. No other mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:55:27.023Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aaaabfd55bf5e2cf5bf8d48
Added to database: 09/16/2026, 14:47:25 UTC
Last enriched: 09/16/2026, 15:01:56 UTC
Last updated: 09/16/2026, 22:11:11 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.