The vulnerability occurs when AMQP 1.0 shovels store the full connection URI—including embedded passwords—without stripping credentials before persisting. The stored URI is exposed through the /api/shovels endpoint and the rabbitmqctl shovel_status command, enabled for users possessing the monitoring tag. An attacker who can read this status can obtain valid usernames and passwords, potentially enabling broader access to the RabbitMQ broker or other services authenticated with those credentials. This constitutes a confidentiality breach of authentication data, identified as CWE‑256 and CWE‑312.

The issue affects RabbitMQ Server deployments that use the Shovel plugin with AMQP 1.0 shovels configured with URI‑embedded credentials, specifically versions earlier than 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

The CVSS score of 5.9 indicates a moderate severity; the EPSS score is not available, so the likelihood of exploitation remains uncertain. RabbitMQ is not listed in the CISA KEV catalog at this time. Successful exploitation requires the user to have the monitoring tag, implying that internal or privileged users could be compromised by the disclosure. Attackers meeting this condition could harvest credential material for lateral movement.