---
id: CVE-2026-106123
title: >-
  The RabbitMQ Java client library allows Java and JVM-based applications to
  connect to and interact with RabbitMQ nodes
summary: >-
  The RabbitMQ Java client library allows Java and JVM-based applications to
  connect to and interact with RabbitMQ nodes. Prior to 5.35.0,
  ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped
  exceptions when AMQP URI …
severity: medium
cvss: 5.7
cvssVector: 'CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'
cwe:
  - CWE-509
vendor: rabbitmq
product: rabbitmq-java-client
affected:
  - rabbitmq-java-client < 5.35.0
  - amqp-client < 5.35.0
published: '2026-10-06'
updated: '2026-10-06'
sourceUpdated: '2026-10-06T20:17:17.930'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-106123'
references:
  - url: >-
      https://github.com/rabbitmq/rabbitmq-java-client/commit/daca1875cdb8b8c0acce78f71103b21a05478446
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-java-client/pull/2052'
    label: security-advisories@github.com
  - url: 'https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.35.0'
    label: security-advisories@github.com
  - url: >-
      https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-h6w7-qmcm-q6xr
    label: security-advisories@github.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-06T19:25:53.529176Z'
cvssSource: cna
ingestedAt: '2026-10-06T19:13:33.942Z'
---

## Overview

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who should not have access to them. This issue is fixed in version 5.35.0.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.