CVE-2026-77404

What it is

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with url.Values. If an application accepts a TLS asset path containing ampersand or equals delimiters and later reparses the serialized URI with ParseURI, the embedded delimiters can create or overwrite connection options, including paths to TLS certificate, key, or CA files. This can corrupt connection configuration or select unintended local cryptographic assets. This issue is fixed in version 1.13.0.

At a glance

Exploitability

Can be exploited locally on the machine with a low-privilege account. High risk of data exposure, data tampering, service disruption.

Exploit odds

0.1% chance of exploitation in the next 30 days (EPSS).

Fix

A patch, advisory or fixed version is referenced. Upgrade or apply it.

Timeline

1. 2026-09-16 15:17 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-09-23 18:19 UTC Last updatedMost recent change to the record

Details

Published

2026-09-16 15:17 UTC

Last modified

2026-09-23 18:19 UTC

Exploit probability

0.1% · EPSS, next 30 days

Weakness

CWE-116

Record status

Awaiting Analysis

Attack profile CVSS 4.0 · 8.7

Attack vector

Local

Complexity

Low

Attack requirements

Present

Privileges needed

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High