CVE-2026-66068
published 2026-09-23CVE-2026-66068: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel…
PriorityP422medium4.4CVSS 3.1
AVLACLPRHUINSUCHINAN
EPSS
0.14%
3.1th percentile
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, State]) formats the entire state map. The 'uris' field holds plaintext URIs after credentials_obfuscation:decrypt (called in rabbit_shovel_util:deobfuscated_uris/2). No format_status/1,2 callback exists in rabbit_shovel_worker to redact it. Triggered when an autodelete shovel (src-delete-after = N) completes. With DEBUG logging enabled, autodelete-shovel completion writes the full shovel state map , including decrypted amqp://user:password@host/ URIs , to the broker log file. Preconditions include Shovel plugin enabled with URI-embedded credentials DEBUG log level (non-default) Autodelete shovel configuration Attacker has log read access. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | rabbitmq_server | >= 3.13.0 < 3.13.15 | 3.13.15 |
| broadcom | rabbitmq_server | >= 4.0.0 < 4.0.20 | 4.0.20 |
| broadcom | rabbitmq_server | >= 4.1.0 < 4.1.11 | 4.1.11 |
| broadcom | rabbitmq_server | >= 4.2.0 < 4.2.6 | 4.2.6 |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
CVSS provenance
nvdv3.14.4MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv4.05.6MEDIUMCVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.6MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5 Shovel plugin rabbit_shovel_util:deobfuscated_uris log file
vuldb·2026-09-23·CVSS 5.6
CVE-2026-66068 [MEDIUM] RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5 Shovel plugin rabbit_shovel_util:deobfuscated_uris log file
A vulnerability marked as problematic has been reported in RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5. This impacts the function rabbit_shovel_util:deobfuscated_uris of the component Shovel plugin. This manipulation of the argument uris causes sensitive information in log files.
This vulnerability is handled as CVE-2026-66068. The attack can be initiated remotely. There is not any exploit available.
It is suggested to upgrade the affected component.
Red Hat
rabbitmq: RabbitMQ: Information disclosure of decrypted Shovel URIs in debug logs
vendor_redhat·2026-09-23·CVSS 5.6
CVE-2026-66068 [MEDIUM] CWE-215 rabbitmq: RabbitMQ: Information disclosure of decrypted Shovel URIs in debug logs
rabbitmq: RabbitMQ: Information disclosure of decrypted Shovel URIs in debug logs
A flaw was found in RabbitMQ, a messaging and streaming broker. When the Shovel plugin is enabled with URI-embedded credentials and debug logging is active, the completion of an autodelete shovel can cause decrypted AMQP (Advanced Message Queuing Protocol) URIs, including usernames and passwords, to be written to the broker's log file. An attacker with access to the log files could exploit this to obtain sensitive credentials, leading to unauthorized access to the messaging broker.
Package: rabbitmq-server4.2 (Red Hat Hardened Images) - Will not fix
Package: rabbitmq-server4.3 (Red Hat Hardened Images) - Affected
No detection rules found.
No public exploits indexed.
2026-09-23
Published