EUVD-2026-80805Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local credential-at-rest disclosure needing a config-traversing logger/APM (AC:H) and process/log access (PR:L); leaked broker creds cross into another system (S:C), confidentiality-only (C:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.
AnalysisAI
Credential disclosure in the RabbitMQ amqp091-go Go client library before 1.13.0 leaves PLAIN and AMQPLAIN SASL passwords sitting in the exported, plaintext Password fields of Connection.Config.SASL for the entire lifetime of an authenticated connection, because Connection.openComplete never clears them after the handshake. Any in-process code that walks the Connection object - reflective or structured loggers, APM agents, debugger utilities, or panic/crash handlers that serialize state - can pull those credentials into logs or dumps that an attacker with local access to the host, logs, or crash artifacts can then read. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires (1) an application using amqp091-go prior to 1.13.0 that authenticates via PLAIN or AMQPLAIN SASL (PlainAuth/AMQPlainAuth), and (2) an in-process consumer that traverses the Connection object after authentication - a reflective/structured logger emitting the config, an APM agent, a debugging utility, or a panic/crash handler that serializes state - plus an attacker able to read those logs or state captures. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:L/SA:L, 7.0) is well-calibrated for what this actually is: a credential-at-rest memory-hygiene flaw (CWE-316), not a remotely triggerable exploit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade amqp091-go to v1.13.0 (or later), available at https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0, which zeroes the SASL password fields after a successful open-ok, redacts PlainAuth/AMQPlainAuth in fmt output, and rebuilds SASL from the URI on reconnect; the fix lands via PR #350 and commit fa013b8447eb60988db3c9281ff6b981e4d2fb4f, with details in advisory GHSA-27gv-rfvv-22mv. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Go services and internal libraries that depend on amqp091-go and identify which connect using PlainAuth or AMQPlainAuth; flag any that run alongside reflective loggers, APM agents, debugger endpoints, or crash-dump collection. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and there
Critical certificate validation bypass in Go crypto/tls during session resumption. If ClientCAs or RootCAs fields are mu
net/url in Go before 1.11.13 and 1.12.x before 1.12.8 mishandles malformed hosts in URLs, leading to an authorization by
Casdoor through 4.4.0 exposes its instance-wide built-in JWT signing private key unmasked through the /api/get-certs and
The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import pa
The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allow
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) c
Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. Rated high severity (CVS
Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command executi
Denial of service in Go's net/url package allows remote unauthenticated attackers to crash applications via malformed UR
The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query p
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today