CVE-2026-106123

UNKNOWN 0.0

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.

CWE	CWE-509
Vendor	rabbitmq
Product	rabbitmq-java-client
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for rabbitmq rabbitmq-java-client

Be the first to know when new unknown vulnerabilities affecting rabbitmq rabbitmq-java-client are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

rabbitmq / rabbitmq-java-client

< 5.35.0

com.rabbitmq / amqp-client

< 5.35.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr github.com: https://github.com/rabbitmq/rabbitmq-java-client/pull/2052 github.com: https://github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446 github.com: https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0