Executive brief
The RabbitMQ Go AMQP client library fails to properly escape TLS certificate and key file paths when building connection strings. An attacker who can control the names of directories containing TLS files can inject malicious URL parameters that override critical connection settings, potentially forcing the client to use unauthorized certificates or alternate authentication credentials when connecting to RabbitMQ brokers.
Technical details
The vulnerability is a query parameter injection flaw in the AMQP 0.9.1 Go client's connection URI formatting logic. The root cause is unsafe string concatenation of TLS filesystem paths directly into URI query parameters without calling `url.QueryEscape()` to properly encode special characters. An attacker who can control TLS file paths (e.g., via directory naming) can craft paths containing URL delimiters like `&` and `=` that break out of their intended parameter and inject new query parameters. When such a malformed URI string is re-parsed via `ParseURI()` during connection retry or state serialization, the injected parameters silently overwrite original configuration values, allowing substitution of certificate files or other connection settings. The attack requires either local filesystem access to control directory names or influence over environment variables specifying TLS paths, but no authentication is required to exploit the injection itself.
Affected products
- RabbitMQ amqp091-go <UNKNOWN>
Timeline
- 2026-09-17: disclosed