CVE-2026-106123 RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
Attackers can view RabbitMQ broker credentials in logs or stack traces when URI parsing fails, exposing sensitive authentication data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-106123?
CVE-2026-106123 is a medium-severity vulnerability in com.rabbitmq amqp-client, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.
Weakness: CWE-209
Which versions are affected by CVE-2026-106123?
2 open source packages ship an affected version, including com.rabbitmq:amqp-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
com.rabbitmq:amqp-client Maven | All versions | 5.35.0 |
com.rabbitmq:amqp-client Maven | All versions | 5.35.0 |
Products include Vmware Rabbitmq Java Client.
How do I fix CVE-2026-106123?
Upgrade com.rabbitmq:amqp-client to 5.35.0 or later.
Is CVE-2026-106123 being exploited?
There is no known exploitation of CVE-2026-106123 in the wild and no public exploit code.
Other vulnerabilities in com.rabbitmq amqp-client
- CVE-2026-106122 RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers
- CVE-2026-106121 RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS
- CVE-2023-46120 RabbitMQ Java client's lack of message size limitation leads to remote DoS attack
Sources
Also known as CLEANSTART-2026-DU73207, CLEANSTART-2026-EV52382, CLEANSTART-2026-OH67049, DEBIAN-CVE-2026-106123, ECHO-98f3-0922-9fc4, GHSA-h6w7-qmcm-q6xr and 15 more.