VDB

CVE-2026-106123

CVE-2026-106123 PUBLISHED CVSS 5.7 MEDIUM

Reported by GitHub_M · Published October 6, 2026

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.

Risk Scores

CVSS 4.0
5.7
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
rabbitmqrabbitmq-java-client< 5.35.0
com.rabbitmqamqp-client< 5.35.0
chainguardnuxeo-20250
com.rabbitmqamqp-client0
chainguardapache-nifi-2.110
chainguardthingsboard0
wolficassandra-reaper0
chainguardtraccar-fips0
chainguardlogstash-8.190
rabbitmqrabbitmq-java-client0
chainguardnuxeo-20230
chainguardtraccar0
wolfilogstash-9.40
chainguardcassandra-reaper0
Mavencom.rabbitmq:amqp-client0
wolfidruid0
wolfithingsboard0
chainguardconductor-fips0
chainguarddruid0
chainguardlogstash-9.40

…and 4 more

Timeline

  • Oct 6, 2026 CVE Published
  • Oct 7, 2026 EPSS Score
  • Oct 7, 2026 Coalition ESS Score
  • Oct 10, 2026 EPSS Score
  • Oct 16, 2026 EPSS Score
  • Oct 19, 2026 CVE Updated
  • Oct 25, 2026 EPSS Score
  • Oct 29, 2026 EPSS Score
  • Oct 30, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›