Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, State]) formats the entire state map. The 'uris' field holds plaintext URIs after credentials_obfuscation:decrypt (called in rabbit_shovel_util:deobfuscated_uris/2). No format_status/1,2 callback exists in rabbit_shovel_worker to redact it. Triggered when an autodelete shovel (src-delete-after = N) completes. With DEBUG logging enabled, autodelete-shovel completion writes the full shovel state map , including decrypted amqp://user:password@host/ URIs , to the broker log file. Preconditions include Shovel plugin enabled with URI-embedded credentials DEBUG log level (non-default) Autodelete shovel configuration Attacker has log read access. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Published: 2026-09-23
Score: 5.6 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Sensitive Information Exposure via broker logs
Action: Patch Now
AI Analysis

Impact

RabbitMQ versions earlier than 3.13.15, 4.0.20, 4.1.11, and 4.2.6 format the entire shovel state map when emitting a DEBUG log upon shovel shutdown. This map contains the ‘uris’ field, which holds plaintext URIs after decryption, including amqp://user:password@host URIs. As a consequence, a DEBUG log reveals these credentials to anyone who can read the broker log files, leading to sensitive information disclosure.

Affected Systems

RabbitMQ Server from versions 3.13.14 and earlier, 4.0.19 and earlier, 4.1.10 and earlier, and 4.2.5 and earlier. The vulnerability is mitigated in releases 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Risk and Exploitability

The CVSS score of 5.6 indicates moderate severity. With the EPSS score unavailable and the vulnerability not listed in the CISA KEV catalog, the probability of exploitation appears moderate but not high. The vulnerability exists in RabbitMQ Server versions earlier than 3.13.15, 4.0.20, 4.1.11, and 4.2.6; it is fixed in those releases and later, including 4.3.0. The attack vector is local or remote when DEBUG logging is enabled for shovels that are configured to auto‑delete; an attacker who can trigger the shutdown and has read access to the broker logs can harvest embedded credentials.

Generated by OpenCVE AI on September 24, 2026 at 13:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade RabbitMQ to the latest supported release that includes the fix (3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0).
  • If an upgrade is not immediately possible, lower the logging level for shovel operations from DEBUG to INFO or higher to prevent the state map from being written in plain text.
  • Restrict file system permissions on broker log files so that only privileged processes can read them, reducing the risk of credential theft.

Generated by OpenCVE AI on September 24, 2026 at 13:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 25 Sep 2026 05:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-215
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N'}

threat_severity

Moderate

Wed, 23 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
First Time appeared Rabbitmq
Rabbitmq rabbitmq-server
Vendors & Products Rabbitmq
Rabbitmq rabbitmq-server

Wed, 23 Sep 2026 20:45:00 +0000

Type Values Removed Values Added
Description RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, State]) formats the entire state map. The 'uris' field holds plaintext URIs after credentials_obfuscation:decrypt (called in rabbit_shovel_util:deobfuscated_uris/2). No format_status/1,2 callback exists in rabbit_shovel_worker to redact it. Triggered when an autodelete shovel (src-delete-after = N) completes. With DEBUG logging enabled, autodelete-shovel completion writes the full shovel state map , including decrypted amqp://user:password@host/ URIs , to the broker log file. Preconditions include Shovel plugin enabled with URI-embedded credentials DEBUG log level (non-default) Autodelete shovel configuration Attacker has log read access. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Title RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs
Weaknesses CWE-532
References
Metrics cvssV4_0

{'score': 5.6, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Rabbitmq Rabbitmq-server
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-24T15:04:56.851Z

Reserved: 2026-07-23T23:25:28.897Z

Link: CVE-2026-66068

cve-icon Vulnrichment

Updated: 2026-09-24T13:58:56.831Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-23T21:16:58.930

Modified: 2026-09-24T16:17:09.043

Link: CVE-2026-66068

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-23T20:24:35Z

Links: CVE-2026-66068 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T14:00:08Z

Weaknesses
  • CWE-215

    Insertion of Sensitive Information Into Debugging Code

  • CWE-532

    Insertion of Sensitive Information into Log File