{"schema":"threatline.record/2","record":{"id":"CVE-2026-106123","aliases":["GHSA-h6w7-qmcm-q6xr"],"summary":"RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()","details":"### Summary\nWhen property-file/Map-based `ConnectionFactory` setup fails while parsing the `uri` key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception's message.\n\n### Details\n`ConnectionFactoryConfigurator.load(ConnectionFactory, Map<String,String>, String)` (`src/main/java/com/rabbitmq/client/ConnectionFactoryConfigurator.java`, lines 142-155):\n\n    String uri = properties.get(prefix + \"uri\");\n    if (uri != null) {\n        try {\n            cf.setUri(uri);\n        } catch (URISyntaxException e) {\n            throw new IllegalArgumentException(\"Error while setting AMQP URI: \" + uri, e);\n        } catch (NoSuchAlgorithmException e) {\n            throw new IllegalArgumentException(\"Error while setting AMQP URI: \" + uri, e);\n        } catch (KeyManagementException e) {\n            throw new IllegalArgumentException(\"Error while setting AMQP URI: \" + uri, e);\n        }\n    }\n\n`uri` is the full AMQP URI — `amqp(s)://username:password@host:port/vhost` — concatenated verbatim into the exception message on any of the three catch branches. No masking/redaction exists anywhere in this class or in `ConnectionFactory.setUri()`. This is the library's documented Spring-Boot/ops-config entry point (`ConnectionFactory.load(...)`, available since 4.4.0), not obscure internal code.\n\nRabbitMQ's own AMQP URI spec (rabbitmq.com/docs/uri-spec) explicitly warns the password \"should avoid leaking... the full URI should not appear in exception messages or log records.\" A sibling method twenty lines away (`ConnectionFactory.setUri(URI)`) already avoids this exact mistake for a different malformed-URI case — this path wasn't caught by that same care.\n\nNote: `KeyManagementException` is declared in the throws clause but not actually reachable via the current `setUri(String)` → `setUri(URI)` call chain — the two real, reachable leak surfaces are the `URISyntaxException` branch (trivial, deterministic, scheme-independent) and the `NoSuchAlgorithmException` branch (real but narrower — `amqps://` only, requires a restricted/FIPS-style default TLS provider).\n\n### PoC\n    Map<String, String> props = new HashMap<>();\n    props.put(\"uri\", \"amqp://svc-account:P@ssW0rd With Space!@broker.internal:5672/prod\");\n    ConnectionFactory cf = new ConnectionFactory();\n    ConnectionFactoryConfigurator.load(cf, props, \"\");\n\nThrows:\n\n    java.lang.IllegalArgumentException: Error while setting AMQP URI: amqp://svc-account:P@ssW0rd With Space!@broker.internal:5672/prod\n\nA password containing a space is entirely ordinary under common corporate password policies, and `java.net.URI` rejects such input outright — this isn't a contrived edge case.\n\n### Impact\nDefault Spring Boot startup-failure logging, an APM/error tracker, a CI job log, or an engineer pasting a stack trace into an internal or public ticket now holds the plaintext broker password, in a system typically far less access-controlled than wherever the credential is normally stored. Note the underlying `URISyntaxException` also carries the same string in its own message, chained as the cause of RabbitMQ's `IllegalArgumentException` — so removing RabbitMQ's own `+ uri` concatenation alone would not fully close this; the raw secret-bearing string also shouldn't be handed to `new URI()` for error-reporting purposes at all.\n\nSuggested fix: don't include the raw `uri` string in the wrapped exception's message — redact the userinfo component (or omit the URI entirely) before including it in any exception text.","categories":["Libraries & packages"],"product":"com.rabbitmq:amqp-client","vendor":"rabbitmq","ecosystem":"maven","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h6w7-qmcm-q6xr","source_modified_at":"2026-10-19T19:27:25Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.rabbitmq:amqp-client"},"range":"<= 5.34.0"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106123","source_modified_at":"2026-10-19T19:27:41.290Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"rabbitmq-java-client","vendor":"rabbitmq","versions":[{"version":"< 5.35.0","status":"affected"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-106123","source_modified_at":"2026-10-19T19:27:41.290Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"amqp-client","vendor":"com.rabbitmq","versions":[{"version":"< 5.35.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-h6w7-qmcm-q6xr","source_modified_at":"2026-10-19T19:45:04.498976139Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"com.rabbitmq:amqp-client","ecosystem":"Maven","purl":"pkg:maven/com.rabbitmq/amqp-client"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.35.0"}]}],"versions":["1.3.0","1.5.4","1.5.5","1.6.0","1.7.2","1.8.0","1.8.1","2.0.0","2.1.0","2.1.1","2.2.0","2.3.0","2.3.1","2.4.1","2.5.0","2.5.1","2.6.0","2.6.1","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.8.3","2.8.4","2.8.5","2.8.6","2.8.7","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.1.0","3.1.1","3.1.2","3.1.3","3.1.4","3.2.0","3.2.1","3.2.2","3.2.3","3.2.4","3.3.0","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.4.0"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-h6w7-qmcm-q6xr","source_modified_at":"2026-10-19T19:27:25Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"maven","name":"com.rabbitmq:amqp-client"},"version":"5.35.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-h6w7-qmcm-q6xr","source_modified_at":"2026-10-19T19:45:04.498976139Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"com.rabbitmq:amqp-client","ecosystem":"Maven","purl":"pkg:maven/com.rabbitmq/amqp-client"},"version":"5.35.0"}],"cvss":5.7,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00158,"percentile":0.04611,"score_date":"2026-10-23"},"published_at":"2026-10-06T18:11:44.133Z","modified_at":"2026-10-19T19:45:04.498976139Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-h6w7-qmcm-q6xr","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-19T19:27:25Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-106123","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T19:27:41.290Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-h6w7-qmcm-q6xr","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T19:45:04.498976139Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-106123","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106123","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-java-client/pull/2052","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-h6w7-qmcm-q6xr","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-06T19:25:53.529176Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T19:45:04.498976139Z","content_hash":"e6d8c56224deb50072748a8739f4bac60b8207f8c9bf6c57e84183f4e60503f1"}}