CVE-2026-106123 RabbitMQ CVE debrief

Who should care

Defenders responsible for RabbitMQ Java client configurations, developers using the library, and security teams monitoring for potential credential leaks should assess exposure and prioritize remediation.

Why it matters

CVE-2026-106123 RabbitMQ Java client leaks plaintext broker credentials in exception messages, posing a risk of credential exposure and compromise. Defenders should verify and remediate affected versions, focusing on configurations where credentials are dynamically set or logged.

• Potential exposure of sensitive credentials in logs or exception messages
• Increased risk of credential compromise or unauthorized access
• Need for verification of affected versions and configurations in use
• Priority for updating to remediated version 5.35.0 or later

Technical summary

The RabbitMQ Java client library leaks plaintext broker credentials in exception messages when property-file/Map-based ConnectionFactory setup fails while parsing the uri key. This occurs in ConnectionFactoryConfigurator.load(), where the raw connection string including username and password is concatenated into the exception message on URISyntaxException, NoSuchAlgorithmException, or KeyManagementException catch branches.

Defensive priority

Defenders should prioritize verifying and remediating affected RabbitMQ Java client versions, focusing on configurations where credentials are dynamically set or logged.

Recommended defensive actions

• Verify and inventory affected RabbitMQ Java client versions in use
• Review configurations where credentials are dynamically set or logged
• Remediate by updating to version 5.35.0 or later
• Monitor exception messages for potential credential leaks
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The RabbitMQ Java client library leaks plaintext broker credentials in exception messages when property-file/Map-based ConnectionFactory setup fails while parsing the uri key. This occurs in ConnectionFactoryConfigurator.load().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.