PatchTheCVECVE-2026-106123: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
CVE-2026-106123 is a medium-severity flaw (CVSS 5.5) affecting rabbitmq java client. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI parsing fails. Because the URI may contain a plaintext username and password, startup logs, application performance monitoring systems, CI logs, and copied stack traces can disclose broker credentials to users who
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 5.5 (Medium) |
| Attack vector | Local |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.2% (top 85%) |
| CISA exploited list | No |
| Weakness | CWE-209 |
| Published | 2026-10-06 |
| Last modified | 2026-10-19 |
Last updated 2026-10-19 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-106123?
rabbitmq java client: upgrade to 5.35.0. Exact commands for each OS are on this page.
Is CVE-2026-106123 being exploited?
CVE-2026-106123 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-106123 affect?
CVE-2026-106123 affects rabbitmq java client. Severity is medium (CVSS 5.5). The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, ConnectionFactoryConfigurator.load() includes the raw uri value in wrapped exceptions when AMQP URI par
How urgent is CVE-2026-106123?
Priority 28/100. Public exploit reference
Software pages
Java vulnerabilities · VMware vulnerabilities · RabbitMQ vulnerabilities
Related CVEs
- CVE-2026-106121 MEDIUM 4.9 UPGRADE The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit
- CVE-2026-106122 HIGH 7.5 UPGRADE The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with Rabbit