CVE-2026-106123: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
(updated )
When property-file/Map-based ConnectionFactory setup fails while parsing the uri key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception’s message.
References
- github.com/advisories/GHSA-h6w7-qmcm-q6xr
- github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446
- github.com/rabbitmq/rabbitmq-java-client/pull/2052
- github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0
- github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr
- nvd.nist.gov/vuln/detail/CVE-2026-106123
Code Behaviors & Features
Detect and mitigate CVE-2026-106123 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →