A high-severity vulnerability in the RabbitMQ amqp091-go client allows for the corruption of connection configurations and potential unauthorized access to cryptographic assets.

This flaw involves improper encoding of output (CWE-116), where TLS certificate and key paths are concatenated directly into query strings. An attacker with local access and low privileges who can manipulate input paths containing specific delimiters can force the application to use unintended cryptographic files.

The ability to manipulate TLS connection parameters poses a significant risk to data integrity and confidentiality. By redirecting an application to use unauthorized certificate or key files, an attacker could potentially facilitate man-in-the-middle attacks or gain unauthorized access to sensitive communications. Given the CVSS score of 8.7, this vulnerability is categorized as high risk, necessitating immediate attention to prevent potential exploitation of inter-service communication channels.

Immediate Action: Update the amqp091-go library to version 1.13.0 or later to ensure proper URL parameter encoding.

Proactive Monitoring: Review application logs for unexpected connection failures or atypical TLS handshake errors that may indicate attempts to inject malicious path delimiters.

Compensating Controls: Ensure that applications utilizing this library run with the principle of least privilege, restricting access to sensitive file systems where cryptographic assets are stored.

Public Exploit Available: Unknown

Organizations utilizing the RabbitMQ amqp091-go client must prioritize upgrading to version 1.13.0. This update addresses the underlying encoding flaw, preventing the injection of parameters that could compromise secure connections. Failure to patch may leave sensitive AMQP communication channels vulnerable to interception or configuration tampering.