The vulnerability arises because the Shovel and Federation gen‑servers in RabbitMQ fail to implement the format_status/2 callback. When these workers crash, the OTP SASL error handler logs the complete process state, which contains clear‑text AMQP passwords and URI strings, to the error log. Consequently, a crash dump or the sys:get_status output can expose authentication secrets to anyone who can read the broker’s logs, enabling credential theft without granting code execution privileges. This represents an Information Exposure weakness (CWE‑200) and a post‑deletion disclosure (CWE‑209).

All RabbitMQ server releases in the 4.0.x, 4.1.x, 4.2.x, and 4.3.x series up to and including 4.3.3 are impacted. In particular, versions 4.0.0‑4.0.23, 4.1.0‑4.1.14, 4.2.0‑4.2.9, and 4.3.0‑4.3.3 expose plain‑text credentials in crash logs.

The CVSS score of 4.6 reflects moderate risk, and the EPSS score of < 1 % indicates a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker would likely need local access to the node’s error logs or the ability to intercept log output. Once obtained, the exposed passwords can be used to authenticate to the broker and impersonate legitimate users, potentially leading to read/write authority over messages. Based on the description, the likely attack vector is local read access to the broker’s error logs, but it could be expanded if logs are forwarded or transmitted. Patching the software removes the flaw by implementing a proper format_status callback that excludes sensitive data from crash reports.