CVE-2026-106123CWE-209

CVE-2026-106123

Medium · published October 6, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
5.7 · CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00158 · 4.6th percentile
Weakness
CWE-209 · Generation of Error Message Containing Sensitive Information
Published
2026-10-06T23:17Z
Affected products (1)
ProductVersionsFixed in
vmware/rabbitmq_java_client< 5.35.05.35.0
References (4)
https://github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446 · [email protected]https://github.com/rabbitmq/rabbitmq-java-client/pull/2052 · [email protected]https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0 · [email protected]https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr · [email protected]
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 06 OCT 18:11Z
    RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load()
    cvelistv5