AZL-103278

See a problem?
Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103278.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-103278
Upstream
Published
2026-09-16T15:17:49Z
Modified
2026-09-19T14:16:36Z
Summary
CVE-2026-77407 affecting package telegraf 1.31.0-31
Details

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, PlainAuth values defined in auth.go retain passwords as exported plaintext fields in Connection.Config.SASL after a successful PLAIN authentication handshake. The Connection.openComplete method in connection.go does not clear those values. Code with access to the Connection object, including reflective loggers, application performance monitoring agents, debugging utilities, and panic handlers, can traverse the configuration and expose the credentials to logs or state captures. The credential remains available for the lifetime of the connection instead of being cleared after authentication. This issue is fixed in version 1.13.0.

References

Affected packages

Azure Linux:3 / telegraf

Package

Name
telegraf
Purl
pkg:rpm/azure-linux/telegraf

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
1.31.0-31

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-103278.json"