Monthly
RabbitMQ Java Client library releases prior to 5.35.0 can leak plaintext broker credentials because ConnectionFactoryConfigurator.load() wraps AMQP URI parsing failures in IllegalArgumentException messages that contain the raw amqp://user:pass@host URI. Any application that supplies credentials inside the connection URI and then hits a setup error - malformed URI syntax or a TLS NoSuchAlgorithmException/KeyManagementException - will write those credentials into startup logs, APM dashboards, CI output, or copied stack traces, where users without broker access may read them. This is a genuine but low-urgency credential-disclosure issue rather than a widely-exploitable critical flaw: exploitation is passive and conditional, requires the attacker to already have read access to the log sink, and only affects the configurator load() path where credentials are embedded in the URI. No public exploit identified at time of analysis; the vulnerable behavior is fixed in version 5.35.0, and the CVSS 4.0 score of 5.7 (AV:L/AC:L/AT:P/PR:L, VC:H) reflects that local, low-privilege, log-reading access with specific preconditions is needed.
RabbitMQ Java Client library releases prior to 5.35.0 can leak plaintext broker credentials because ConnectionFactoryConfigurator.load() wraps AMQP URI parsing failures in IllegalArgumentException messages that contain the raw amqp://user:pass@host URI. Any application that supplies credentials inside the connection URI and then hits a setup error - malformed URI syntax or a TLS NoSuchAlgorithmException/KeyManagementException - will write those credentials into startup logs, APM dashboards, CI output, or copied stack traces, where users without broker access may read them. This is a genuine but low-urgency credential-disclosure issue rather than a widely-exploitable critical flaw: exploitation is passive and conditional, requires the attacker to already have read access to the log sink, and only affects the configurator load() path where credentials are embedded in the URI. No public exploit identified at time of analysis; the vulnerable behavior is fixed in version 5.35.0, and the CVSS 4.0 score of 5.7 (AV:L/AC:L/AT:P/PR:L, VC:H) reflects that local, low-privilege, log-reading access with specific preconditions is needed.