com.rabbitmq:amqp-client

Maven Compromised

1

report

Attack type: Other

Reports

Other CVE-2026-106123 Versions: <= 5.34.0 11d ago by isitcompromised.com

RabbitMQ Java client: plaintext broker credentials leaked in exception message from ConnectionFactoryConfigurator.load() ### Summary When property-file/Map-based `ConnectionFactory` setup fails while parsing the `uri` key, the library wraps the underlying exception with the raw connection string — including the plaintext username and password — baked verbatim into the new exception's message. ### Details `ConnectionFactoryConfigurator.load(ConnectionFactory, Map<String,String>, String)` (`src/main/java/com/rabbitmq/client/ConnectionFactoryConfigurator.java`, lines 142-155): String uri = properties.get(prefix

View evidence

Have more info?

Submit additional evidence or a new report for this package.

Submit a report