CVE-2026-77407

The record

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.

Affected packages

Related vulnerabilities

• CVE-2026-8636 IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9… CWE-316
• CVE-2026-0857 Cleartext Storage of Sensitive Information in Memory vulnerability in Mesalvo Meona… CWE-316
• CVE-2026-24319 In SAP Business One, sensitive information is written to the application�s memory dump… CWE-316
• GHSA-62vx-hpcr-m9ch @perfood/couch-auth may expose session tokens, passwords CWE-316
• CVE-2025-60794 @perfood/couch-auth may expose session tokens, passwords CWE-316
• CVE-2025-4618 A sensitive information disclosure vulnerability in Palo Alto Networks Prisma® Browser… CWE-316
• CVE-2025-42888 SAP GUI for Windows may allow a highly privileged user on the affected client PC to… CWE-316
• CVE-2025-60791 Easywork Enterprise 2.1.3.354 is vulnerable to Cleartext Storage of Sensitive Information… CWE-316