Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-106123 · GHSA-h6w7-qmcm-q6xr

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()

Risk score
44/100
CVSS
5.5 v3.1
Exploit chance (30 days)
0.2%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, star…
Affected
com.rabbitmq:amqp-client (maven) <= 5.34.0
Fix
Upgrade com.rabbitmq:amqp-client to 5.35.0 or later.
Exploitation
Public proof of concept

Story map

Story map: com.rabbitmq:amqp-clientTHE FLAWSTHE FIXCVE-2026-106123RabbitMQ Java client: plaintextbroker credentials leaked inexception message from…CVSS 5.5 · EPSS 0%CVE-2026-106121RabbitMQ: JSONReader in thedefault JSON-RPC mappernever terminates on…CVSS 7.5 · EPSS 1%CVE-2026-106122RabbitMQ: Malformed UTF-8 inshortstr propertiespermanently disables RPC…CVSS 7.5 · EPSS 0%Upgrade…5.35.0 · 5.37.0 · 5.36.0or later on your release lineWho is exposedcom.rabbitmq:amqp-client(maven) <= 5.36.0AMBER · PATCH THIS WEEKcom.rabbitmq:amqp-clientThe RabbitMQ Java client libraryallows Java and JVM-basedapplications to connect to andinteract with RabbitMQ nodes.Prior to 5.37.0,com.rabbitmq.tools.json.JSONReader.read() fails to terminate…Where it standsPublic proof of conceptCONNECTS TOSame weaknessCWE-209 (CWE-209)13 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

com.rabbitmq:amqp-client: Amber, patch this week. The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read() fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners do not stop at Charac…

The flaws

  • CVE-2026-106123: RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() (CVSS 5.5 · EPSS 0%)
  • CVE-2026-106121: RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS (CVSS 7.5 · EPSS 1%)
  • CVE-2026-106122: RabbitMQ: Malformed UTF-8 in shortstr properties permanently disables RPC consumers (CVSS 7.5 · EPSS 0%)

The fix

Upgrade com.rabbitmq:amqp-client: 5.35.0 · 5.37.0 · 5.36.0 or later on your release line

Who is exposed: com.rabbitmq:amqp-client (maven) <= 5.36.0

Where it stands

  • Public proof of concept

Connects to

Why it is Yellow

  • CVSS 5.5 medium
  • Public exploit or proof of concept referenced
  • On your watchlist: Maven

Affected packages

PackageEcosystemVulnerableFixed in
com.rabbitmq:amqp-clientmaven<= 5.34.05.35.0

References

Original description

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.

Last activity 6 Oct 2026. Patch Forecast updates every hour.