CVE-2026-67221

Received Received - Intake

Information Disclosure in RabbitMQ Shovel Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-67221

Affected Vendors & Products

Vendor	Product	Version / Range
rabbitmq	rabbitmq	to 4.3.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

RabbitMQ is a messaging broker. Prior to certain versions, the AMQP 1.0 shovel feature stored connection URIs including passwords in plaintext. This was visible via API or rabbitmqctl commands. The issue was fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Detection Guidance

Check for AMQP 1.0 shovels with URI-embedded credentials by inspecting GET /api/shovels or running rabbitmqctl shovel_status. Ensure the Shovel plugin is enabled and monitor for exposed URIs containing passwords.

Impact Analysis

If you use RabbitMQ with AMQP 1.0 shovels configured with URI-embedded credentials, an attacker with monitoring access could retrieve stored URIs and expose passwords. This could lead to unauthorized access to messaging systems or data breaches.

Mitigation Strategies

Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later. Remove URI-embedded credentials from AMQP 1.0 shovel configurations and avoid storing raw URIs with passwords.

Hi! I’m here to help you understand CVE-2026-67221. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70