External risk intelligence

RabbitMQ Go Client Negotiates Insecure TLS Versions

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-77405

This is a client-side library used by developers to build applications. It is not a standalone service or edge-facing appliance. While the library facilitates network connections, the vulnerable TLS configuration depends on how the developer implements the client within their specific application environment.

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in a Go AMQP client library that could allow a network attacker to weaken transport protection for messages and credentials if older TLS versions are negotiated. The issue is related to the library's TLS configuration not explicitly setting a minimum TLS version, potentially allowing negotiation of obsolete protocols on systems using older Go runtimes.

Vulnerability may weaken message transport security.
Confirms exposure and relevance for affected applications.
Assess client library usage for potential protocol downgrade.

Attack Path

How an attacker could exploit the issue

An attacker on the network could potentially intercept and weaken the transport security for messages and credentials by forcing a connection to use an older, less secure TLS version. This is possible if the RabbitMQ Go client is built with a default Go runtime that permits TLS 1.0 or 1.1 and is configured to connect using an `amqps` URI.

Network access required to influence TLS.
Vulnerability triggered by connecting via `amqps` URI.
Risk of weakened transport security.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, a network attacker could weaken transport protection for AMQP messages and credentials by exploiting a TLS configuration weakness in older builds of the Go AMQP 0.9.1 client. This occurs when the client negotiates an obsolete protocol version, potentially exposing sensitive information exchanged over the connection.

AMQP messages and credentials.
Negotiating obsolete TLS protocol versions.
Weakened transport protection for sensitive data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts applications using the amqp091-go client library, specifically in how it handles TLS configurations. Application development teams are likely responsible for integrating this library. The first step is to identify all applications utilizing this client, assess their exposure, and confirm which deployments are critical or reachable by network attackers.

Application development teams own the fix.
Verify amqp091-go client usage and TLS settings.
Plan updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the RabbitMQ amqp091-go library?

It is a specialized software library written in the Go programming language that allows applications to communicate with RabbitMQ message brokers using the AMQP 0.9.1 protocol. Developers integrate this library into their own software to handle data exchange, messaging queues, and authentication securely over network connections.

What does CWE-326 mean in the context of CVE-2026-77405?

CWE-326 refers to the use of inadequate encryption strength. In this specific vulnerability, the client library fails to enforce a modern minimum version of the TLS protocol. Because it does not explicitly require TLS 1.2 or higher, the library may default to older, deprecated protocols if the underlying system environment allows them, leaving the connection susceptible to protocol downgrade attacks.

How does an attacker trigger this TLS vulnerability?

An attacker must be positioned on the network to intercept or influence the connection handshake. This flaw is specifically triggered when the application initiates a connection using an amqps URI. Notably, the vulnerability is not triggered if the application environment or Go runtime has been strictly configured to disable obsolete TLS versions like 1.0 or 1.1 at the system level.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal indicates that risk is unlikely for broad infrastructure, as this is a developer-focused library rather than a standalone service. Because the vulnerability depends on how your specific application initializes the library and the TLS settings of its hosting environment, you should focus your attention on custom applications that utilize this client for external network communications.

What are the first steps to address this CVE?

You should audit your software inventory to locate applications using amqp091-go versions prior to 1.13.0. Once identified, development teams should prioritize updating the library to version 1.13.0 or later, which includes the necessary fix to enforce secure TLS configurations. Reviewing your deployment's TLS policy to ensure that modern, secure protocols are mandated is also a recommended defensive measure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.