CVE-2026-77407 — amqp091-go

Summary

An information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the Connection.Config.SASL field stores the Authentication implementation state used to establish the session.

For standard PLAIN authentication, this state utilizes the PlainAuth struct, which defines both Username and Password as publicly exported, plaintext string fields. Because this sensitive data is retained permanently in-memory within an exported field structure, any peripheral code, internal package, reflective logger, dependency, or automated debugging utility with access to the core *Connection object can read and expose the raw credentials.

Vulnerability Details

Mechanism

The vulnerability stems from the structural design of the configuration storage used during and after the AMQP handshake:

// auth.go:21-23
type PlainAuth struct {
    Username string
    Password string  // exported plaintext
}

When an application initializes a connection, the PlainAuth object is deeply nested inside the configuration structure (Connection.Config). Even after the handshake concludes and authentication is complete, this structure persists natively in-memory for the duration of the network connection's lifecycle.

Because Password is an exported string field, standard automated inspection mechanisms can read its value without restriction.

Affected Code Paths & Integrations

Any sub-component or library that traverses or reads the *Connection object will inadvertently read the plaintext password, including:

• Reflective Loggers: Structured logging frameworks that serialize nested configuration structs into JSON/Log formats.
• APM & Performance Agents: Automated telemetry or Application Performance Monitoring tools that capture state snapshots.
• Debugging & Panic Handlers: Mid-tier software or dump libraries designed to capture goroutine state or print deep struct hierarchies upon program errors or signals.

Impact

The credential remains vulnerable to leak paths into logging pipelines, log aggregators, security information and event management (SIEM) systems, or standard output. Once transmitted to external log infrastructure, these credentials become accessible to unprivileged operators or any actor with access to log archives.

Attack Vector

An attacker does not necessarily need direct remote code execution to exploit this flaw; instead, the vulnerability acts as a credential harvesting vector inside multi-tenant environments or via secondary log exposure:

1. Configuration Dump: An operator configures a standard reflective logger or third-party APM package to capture system state parameters, including the active AMQP *Connection object.
2. Reflective Access: The inspection engine uses Go's reflect package to walk the structural hierarchy, pulling the string value from Connection.Config.SASL.(*PlainAuth).Password.
3. Exfiltration: The plaintext password is written to standard system logs, which are then scraped into shared logging aggregators, exposing production infrastructure credentials to a wider audience.