CVE-2026-106123

Overview

The RabbitMQ Java Client is the RabbitMQ team's AMQP 0.9.1 client library, which allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. It is published to Maven Central as com.rabbitmq:amqp-client, and Spring AMQP applications, including Spring Boot ones, use it through spring-rabbit's CachingConnectionFactory.

An information exposure vulnerability (CVE-2026-106123) has been identified in the ConnectionFactoryConfigurator class of the RabbitMQ Java Client, which allows attackers with access to application logs, error trackers or stack traces to read the plaintext broker username and password from the exception thrown when a configured AMQP URI cannot be applied.

Per OWASP: Access control enforces policy such that users cannot act outside of their intended permissions. Failures typically lead to unauthorized information disclosure, modification, or destruction of all data or performing a business function outside the user's limits.

This issue affects RabbitMQ Java Client versions prior to 5.35.0.

Details

Module Info

• Product: RabbitMQ Java Client
• Affected packages: com.rabbitmq:amqp-client
• Affected versions: <5.35.0
• GitHub repository: https://github.com/rabbitmq/rabbitmq-java-client
• Published packages: https://central.sonatype.com/artifact/com.rabbitmq/amqp-client
• Package manager: Maven
• Fixed in:
  • OSS RabbitMQ Java Client 5.35.0
  • NES for RabbitMQ Java Client v5.24.2

Vulnerability Info

This Medium-severity vulnerability is found in the com.rabbitmq:amqp-client package in versions prior to 5.35.0 of the RabbitMQ Java Client.

ConnectionFactoryConfigurator.load(ConnectionFactory, Map<String, String>, String) is the configuration path behind the ConnectionFactory.load(...) overloads, which read connection settings from a property file, a Properties object or a Map. When the settings contain a uri key, the method passes the value to ConnectionFactory.setUri(String), which parses it with new URI(uriString). An AMQP URI normally carries the broker credentials in its userinfo component (amqp://username:password@host:port/vhost). If applying the URI fails, every catch branch concatenates the raw value into the message of the IllegalArgumentException it throws and chains the original exception as its cause:

String uri = properties.get(prefix + "uri");
if (uri != null) {
    try {
        cf.setUri(uri);
    } catch (URISyntaxException e) {
        throw new IllegalArgumentException("Error while setting AMQP URI: " + uri, e);
    } catch (NoSuchAlgorithmException e) {
        throw new IllegalArgumentException("Error while setting AMQP URI: " + uri, e);
    } catch (KeyManagementException e) {
        throw new IllegalArgumentException("Error while setting AMQP URI: " + uri, e);
    }
}

The URISyntaxException branch is reached deterministically by any URI that java.net.URI rejects, for example one whose password contains a space or another character that is not percent-encoded. The chained URISyntaxException also repeats the raw input in its own message. The NoSuchAlgorithmException branch is reachable for amqps:// URIs when the default TLS provider cannot supply the required algorithm. In each case the plaintext password ends up in the exception text, so it is written wherever the application reports the failure, such as startup failure logs, error tracking services, CI logs or stack traces copied into tickets, which are typically far less access-controlled than the store that normally holds the credential.

Steps to Reproduce

1. Add com.rabbitmq:amqp-client 5.34.0 or earlier as a dependency of a Maven project.

2. Run the following code, which configures a connection factory from a Map whose URI contains a password with spaces:

import com.rabbitmq.client.ConnectionFactory;
import com.rabbitmq.client.ConnectionFactoryConfigurator;
import java.util.HashMap;
import java.util.Map;

public class Repro {
    public static void main(String[] args) {
        Map<String, String> props = new HashMap<>();
        props.put("uri", "amqp://svc-account:P@ssW0rd With Space!@broker.internal:5672/prod");
        ConnectionFactory cf = new ConnectionFactory();
        ConnectionFactoryConfigurator.load(cf, props, "");
    }
}

3. Observe that the thrown exception contains the full credentials:

java.lang.IllegalArgumentException: Error while setting AMQP URI: amqp://svc-account:P@ssW0rd With Space!@broker.internal:5672/prod

Mitigation

The RabbitMQ team lists the AMQP 0.9.1 Java Client 5.x series as currently supported and ships fixes in new 5.x releases. Upstream has made no 5.24.x release since 5.24.0 (December 2024), so no 5.24.x release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a release of the RabbitMQ Java Client 5.x series that contains the fix.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• Yazan Balawneh (finder)