CVE-2026-77407

## Summary An information disclosure vulnerability exists in the AMQP client implementation's authentication handling configuration. Following a successful connection handshake, the `Connection.Config.SASL` field stores the `Authentication` implementation state used to establish the session. For standard `PLAIN` authentication, this state utilizes the `PlainAuth` struct, which defines both `Username` and `Password` as publicly exported, plaintext string fields. Because this sensitive data is retained permanently in-memory within an exported field structure, any peripheral code, internal package, reflective logger, dependency, or automated debugging utility with access to the core `*Connection` object can read and expose the raw credentials. --- ## Vulnerability Details ### Mechanism The vulnerability stems from the structural design of the configuration storage used during and after the AMQP handshake: ```go // auth.go:21-23 type PlainAuth struct { Username string Password string // exported plaintext } ``` When an application initializes a connection, the `PlainAuth` object is deeply nested inside the configuration structure (`Connection.Config`). Even after the handshake concludes and authentication is complete, this structure persists natively in-memory for the duration of the network connection's lifecycle. Because `Password` is an exported string field, standard automated inspection mechanisms can read its value without restriction. ### Affected Code Paths & Integrations Any sub-component or library that traverses or reads the `*Connection` object will inadvertently read the plaintext password, including: * **Reflective Loggers:** Structured logging frameworks that serialize nested configuration structs into JSON/Log formats. * **APM & Performance Agents:** Automated telemetry or Application Performance Monitoring tools that capture state snapshots. * **Debugging & Panic Handlers:** Mid-tier software or dump libraries designed to capture goro