CVE-2026-77407: amqp091-go: cleartext AMQP password retained in memory

## Summary An information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the `Connection.Config.SASL` field stores the `Authentication` implementation state used to establish the session. For standard `PLAIN` authentication, this state utilizes the `PlainAuth` struct, which defines both `Username` and `Password` as publicly exported, plaintext string fields. Because this sensitive data is retained permanently in-memory within an exported field structure, any peripheral code, internal package, reflective logger, dependency, or automated debugging utility with access to the core `*Connection` object can read and expose the raw credentials. --- ## Vulnerability Details ### Mechanism The vulnerability stems from the structural design of the configuration storage used during and after the AMQP handshake: ```go // auth.go:21-23 type PlainAuth struct { Username string Password string // exported plaintext } ``` When an application initializes a connection, the `PlainAuth` object is deeply nested inside the configuration structure (`Connection.Config`). Even after the handshake concludes and authentication is complete, this structure persists natively in-memory for the duration of the network connection's lifecycle. Because `Password` is an exported string field, standard automated inspection mechanisms can read its value without restriction. ### Affected Code Paths & Integrations Any sub-component or library that traverses or reads the `*Connection` object will inadvertently read the plaintext password, including: * **Reflective Loggers:** Structured logging frameworks that serialize nested configuration structs into JSON/Log formats. * **APM & Performance Agents:** Automated telemetry or Application Performance Monitoring tools that capture state snapshots. * **Debugging & Panic Handlers:** Mid-tier software or dump libraries designed to capture goroutine state or print deep struct hierarchies upon program errors or signals. ### Impact The credential remains vulnerable to leak paths into logging pipelines, log aggregators, security information and event management (SIEM) systems, or standard output. Once transmitted to external log infrastructure, these credentials become accessible to unprivileged operators or any actor with access to log archives. --- ## Attack Vector An attacker does not necessarily need direct remote code execution to exploit this flaw; instead, the vulnerability acts as a credential harvesting vector inside multi-tenant environments or via secondary log exposure: 1. **Configuration Dump:** An operator configures a standard reflective logger or third-party APM package to capture system state parameters, including the active AMQP `*Connection` object. 2. **Reflective Access:** The inspection engine uses Go's `reflect` package to walk the structural hierarchy, pulling the string value from `Connection.Config.SASL.(*PlainAuth).Password`. 3. **Exfiltration:** The plaintext password is written to standard system logs, which are then scraped into shared logging aggregators, exposing production infrastructure credentials to a wider audience.

An ML platform team runs Go microservices that consume inference jobs from RabbitMQ. A debug-level structured logger or APM agent is configured to capture application state, and it serializes the amqp091-go Connection object, including SASL.(*PlainAuth).Password, into the central log platform. A contractor or compromised analyst account with read access to logs finds the plaintext password. They connect to the broker, consume or publish messages on the queues that carry model inputs, outputs or training job parameters, and tamper with the jobs or read sensitive data.