CVE-2026-66068

Received Received - Intake

Information Disclosure in RabbitMQ Shovel Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, State]) formats the entire state map. The 'uris' field holds plaintext URIs after credentials_obfuscation:decrypt (called in rabbit_shovel_util:deobfuscated_uris/2). No format_status/1,2 callback exists in rabbit_shovel_worker to redact it. Triggered when an autodelete shovel (src-delete-after = N) completes. With DEBUG logging enabled, autodelete-shovel completion writes the full shovel state map , including decrypted amqp://user:password@host/ URIs , to the broker log file. Preconditions include Shovel plugin enabled with URI-embedded credentials DEBUG log level (non-default) Autodelete shovel configuration Attacker has log read access. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-66068

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.3.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-532	The product writes sensitive information to a log file.

Attack-Flow Graph

Executive Summary

This vulnerability in RabbitMQ versions before 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 allows plaintext credentials to be logged when an autodelete shovel completes. The issue occurs because the Shovel state map, including decrypted URIs with credentials, is written to the log file without redaction when DEBUG logging is enabled.

Detection Guidance

Check RabbitMQ log files for entries containing 'shutting down Shovel' and autodelete shovel completion logs. Look for plaintext URIs in the format 'amqp://user:password@host/'.

Impact Analysis

If you have RabbitMQ with the Shovel plugin enabled, DEBUG logging active, and autodelete shovels configured with URI-embedded credentials, an attacker with log read access could extract plaintext credentials from the log files. This could lead to unauthorized access to RabbitMQ or connected systems.

Compliance Impact

This vulnerability could violate compliance requirements that mandate protection of sensitive data like credentials. Exposure of plaintext credentials in logs may lead to breaches of GDPR (data protection) or HIPAA (privacy and security rules), potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later. Disable DEBUG logging level if not required. Restrict log file access to authorized personnel only.

Hi! I’m here to help you understand CVE-2026-66068. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70