CVE-2026-106123
Description
A flaw was found in the RabbitMQ Java client library, leading to information disclosure. When parsing of an Advanced Message Queuing Protocol (AMQP) Uniform Resource Identifier (URI) fails, the connection configuration loader includes the raw URI string in exception messages. If the URI contains plaintext credentials, an unauthorized user with access to application logs, stack traces, or monitoring systems can view sensitive broker authentication details.
Statement
A MODERATE information disclosure flaw was found in the RabbitMQ Java client library (amqp-client), which is shipped in Red Hat JBoss Fuse and the Red Hat build of Apache Camel. When parsing of an AMQP URI provided through property-file or map-based ConnectionFactory configuration fails, ConnectionFactoryConfigurator.load() wraps the underlying exception with the raw connection string. Because the URI may contain a plaintext username and password, an unauthorized user with access to application startup logs, CI logs, monitoring or error-tracking systems, or copied stack traces can read the embedded broker credentials and use them to access the RabbitMQ broker. Red Hat rates this flaw MODERATE with a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), consistent with the upstream MODERATE rating.
Both Red Hat JBoss Fuse and the Red Hat build of Apache Camel ship affected versions of the amqp-client library. For the Red Hat build of Apache Camel, the fix is deferred because this MODERATE-severity flaw has a CVSS score below 7.0, which does not meet the criteria for scheduling an update; the residual risk is that plaintext credentials embedded in AMQP URIs can continue to be exposed through logged exception messages until a fix is delivered. The affected Red Hat JBoss Fuse stream is out of support scope, so no fix is planned for it.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Upstream has fixed this issue in version 5.35.0 of the RabbitMQ Java client; no fixed Red Hat packages are currently available for the affected products, whose fixes are deferred or out of support scope.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | High | High | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | None | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Application Data
Often this will either reveal sensitive information which may be used to launch another, more focused attack or disclose private information stored in the server. For example, an attempt to exploit a path traversal weakness (CWE-22) might yield the full pathname of the installed application. In turn, this could be used to select the proper number of ".." sequences to navigate to the targeted file. An attack using SQL injection (CWE-89) might not initially succeed, but an error message could reveal the malformed query, which would expose query logic and possibly even passwords or other sensitive information used within the query.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
