Vulnerabilities

Security incident · CVE-2026-106123

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

Published Oct 7, 2026 · catalog updated Oct 19, 2026 · RabbitMQ Java client: plaintext

Open the advisory

Exploitation likelihood is not on this record for CVE-2026-106123. A missing EPSS score is not a low risk. Compare RabbitMQ Java client: plaintext with the linked advisory before you change production.

Severity

Medium5.5

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

Awaiting synchronization with FIRST

Remediation

Advisory link

Affected products

Maven com.rabbitmq:amqp-client

### Summary When property-file/Map-based setup fails while parsing the key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception's message. ### Details ( , lines 142-155): String uri = properties.get(prefix + "uri"); if (uri != null) { try { cf.setUri(uri); } catch (URISyntaxException e) { throw new IllegalArgumentException("Error while setting AMQP URI: " + uri, e); } catch (NoSuchAlgorithmException e) { throw new IllegalArgumentException("Error while setting AMQP URI: " + uri, e); } catch (KeyManagementException e) { throw new IllegalArgumentException("Error while setting AMQP URI: " + uri, e); } } is the full AMQP URI — — concatenated verbatim into the exception message on any of the three catch branches. No masking/redaction exists anywhere in this class or in . This is the library's documented Spring-Boot/ops-config entry point ( , available since 4.4.0), not obscure internal code. RabbitMQ's own AMQP URI spec (rabbitmq.com/docs/uri-spec) explicitly warns the password "should avoid leaking... the full URI should not appear in exception messages or log records." A sibling method twenty lines away ( ) already avoids this exact mistake for a different malformed-URI case — this path wasn't caught by that same care. Note: is declared in the throws clause but not actually reachable via the current → call chain — the two real, reachable leak surfaces are the branch (trivial, deterministic, scheme-independent) and the branch (real but narrower — only, requires a restricted/FIPS-style default TLS provider). ### PoC Map props = new HashMap<>(); props.put("uri", "amqp://svc-account:P@ssW0rd With Space!@broker.internal:5672/prod"); ConnectionFactory cf = new ConnectionFactory(); ConnectionFactoryConfigurator.load(cf, props, ""); Throws: java.lang.IllegalArgumentException: Error while setting AMQP URI: amqp://svc-account:P@ssW0rd With Space!@broker.internal:5672/prod