Information Exposure Through an Error Message in RabbitMQ Java Client Library - #VU144579
Published: August 21, 2026
Vulnerability identifier: #VU144579
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-209
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to insertion of sensitive information into an error message in ConnectionFactoryConfigurator.load() when parsing a property-file or map-supplied AMQP URI. A local user can supply a malformed connection URI to disclose sensitive information.
The issue is triggered when connection setup fails while processing the uri key, and the resulting exception message can include plaintext username and password from the AMQP URI.
Affected software
RabbitMQ Java Client Library
Remediation
Install security update from vendor's website.
RabbitMQ Java Client Library - update to 5.35.0