CVE-2026-77407

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.

• CWE-316

• https://github.com/rabbitmq/amqp091-go/commit/fa013b8447eb60988db3c9281ff6b981e4d2fb4f
• https://github.com/rabbitmq/amqp091-go/pull/350
• https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0
• https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-27gv-rfvv-22mv

Published

Sep 16, 2026

Last Modified

Sep 23, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-7740A security vulnerability has been detected in justdan96 tsMu…3.3
• CVE-2026-77401Zope AccessControl provides a general security framework for…6.8
• CVE-2026-77403RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.9
• CVE-2026-77404RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.7
• CVE-2026-77405RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…9.4
• CVE-2026-77406RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.2
• CVE-2026-77408RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…9.1
• CVE-2026-77409RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.2
• CVE-2026-7741A vulnerability was detected in CodeAstro Online Classroom 1…6.3
• CVE-2026-77410RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.9
• CVE-2026-77411RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…9.5
• CVE-2026-77412RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13…8.9