CVE-2026-67221

RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords

State: Published
Severity: 5.9 Medium
Published: Sep 23, 2026
Updated: Sep 24, 2026
Reserved: Jul 28, 2026

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Scores

CVSS	Score	Vector	Source
4.0	5.9 Medium	CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-312 Cleartext Storage of Sensitive Information

Affected Products

Product	Versions
rabbitmq-serverrabbitmq	>= 3.13.0, < 3.13.15Affected >= 4.0.0, < 4.0.20Affected >= 4.1.0, < 4.1.11Affected >= 4.2.0, < 4.2.6Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.