---
id: CVE-2026-106123
title: >-
  The RabbitMQ Java client library allows Java and JVM-based applications to
  connect to and interact with RabbitMQ nodes
summary: >-
  The RabbitMQ Java client library allows Java and JVM-based applications to
  connect to and interact with RabbitMQ nodes. Prior to 5.35.0,
  ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped
  exceptions when AMQP URI …
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-509
  - CWE-209
vendor: vmware
product: rabbitmq_java_client
affected:
  - rabbitmq_java_client < 5.35.0
patched:
  - rabbitmq_java_client 5.35.0
published: '2026-10-06'
updated: '2026-10-09'
sourceUpdated: '2026-10-09T18:17:06.350'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106123'
references:
  - url: >-
      https://github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-java-client/pull/2052'
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106123'
  - url: 'https://github.com/advisories/GHSA-h6w7-qmcm-q6xr'
tags:
  - nvd
  - cve.org
  - ghsa
  - maven
epss: 0.00239
epssPercentile: 0.14908
aliases:
  - GHSA-h6w7-qmcm-q6xr
ecosystem: maven
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-06T19:25:53.529176Z'
scores:
  nvd: 5.5
  cna: 5.7
  ghsa: 5.5
ingestedAt: '2026-10-06T19:13:33.942Z'
---

## Overview

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.

## Affected

- `rabbitmq_java_client < 5.35.0`

## Remediation

Upgrade past the affected range:

- `rabbitmq_java_client 5.35.0`

## Package advisory (CVE-2026-106123)

Affected packages:

- `com.rabbitmq:amqp-client <= 5.34.0`

Patched in:

- `com.rabbitmq:amqp-client 5.35.0`

Source: https://github.com/advisories/GHSA-h6w7-qmcm-q6xr