highCVE-2026-77404Sep 17, 2026

CVE-2026-77404: amqp091-go TLS Path Query Parameter Injection

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

The RabbitMQ Go AMQP client builds connection URIs by pasting raw TLS file paths into the query string without URL-encoding them, so a path containing '&' or '=' can silently overwrite connection…

Packagegithub.com/rabbitmq/amqp091-go
Ecosystemgo
Affected< 1.13.0
Fixed in1.13.0

The problem

In versions before 1.13.0, the URI.String method in uri.go builds the AMQPS query string by concatenating CertFile, KeyFile, CACertFile, and ServerName directly into the raw string with no encoding. There is no call to url.Values or url.QueryEscape.

If any of those values contain '&' or '=', the characters retain their URL meaning. When the serialized URI is passed back into ParseURI, the injected tokens are treated as separate query parameters and can overwrite legitimate ones, including the paths to CA certificates, client certificates, or private keys.

Proof of concept

A working proof-of-concept for CVE-2026-77404 in github.com/rabbitmq/amqp091-go, with the exact payload below.

go
// Attacker-controlled or environment-supplied certfile path:
certPath := "/tmp/client.crt&cacertfile=/tmp/attacker_ca.crt"

// URI.String() produces (pre-patch, no escaping):
// amqps://user:pass@rabbitmq.example.com/%2F?certfile=/tmp/client.crt&cacertfile=/tmp/attacker_ca.crt&cacertfile=/legitimate/ca.crt

// ParseURI re-parses this and the injected cacertfile wins,
// loading the attacker-controlled CA instead of the real one.
parsedURI, _ := amqp.ParseURI(uri.String())
// parsedURI.CACertFile == "/tmp/attacker_ca.crt"

The vulnerable code appended TLS fields to the query string via string concatenation, e.g. '?certfile=' + certPath. Because certPath is never passed through url.QueryEscape or url.Values.Set, a literal '&' inside the path terminates the current parameter and starts a new one.

The patch (PR #352, commit 743d488e) replaced all manual concatenation with url.Values, which percent-encodes '&' to '%26' and '=' to '%3D'. After the fix, the same malicious path is serialized as certfile=%2Ftmp%2Fclient.crt%26cacertfile%3D%2Ftmp%2Fattacker_ca.crt and ParseURI reads it as a single opaque value.

CWE-116 (Improper Encoding or Escaping of Output).

The fix

Upgrade github.com/rabbitmq/amqp091-go to v1.13.0. The fix is in commit 743d488e (PR #352): URI.String now builds the query string with url.Values so all TLS path values are percent-encoded before being written into the URI. No configuration workaround exists for older versions; upgrade is the only remediation.

Reported by suchitd.

References: [1][2][3][4][5][6]

Related research