CVE-2026-67221
published 2026-09-23CVE-2026-67221: RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls…
PriorityP428medium4.9CVSS 3.1
AVNACLPRHUINSUCHINAN
EPSS
0.19%
8.2th percentile
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| broadcom | rabbitmq_server | >= 3.13.0 < 3.13.15 | 3.13.15 |
| broadcom | rabbitmq_server | >= 4.0.0 < 4.0.20 | 4.0.20 |
| broadcom | rabbitmq_server | >= 4.1.0 < 4.1.11 | 4.1.11 |
| broadcom | rabbitmq_server | >= 4.2.0 < 4.2.6 | 4.2.6 |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
| rabbitmq | rabbitmq-server | — | — |
CVSS provenance
nvdv3.14.9MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
nvdv4.05.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rabbitmq: RabbitMQ: Information disclosure of AMQP 1.0 shovel URI passwords
vendor_redhat·2026-09-23·CVSS 5.9
CVE-2026-67221 [MEDIUM] CWE-256 rabbitmq: RabbitMQ: Information disclosure of AMQP 1.0 shovel URI passwords
rabbitmq: RabbitMQ: Information disclosure of AMQP 1.0 shovel URI passwords
A flaw was found in RabbitMQ, a messaging and streaming broker. The AMQP 1.0 shovel component incorrectly stores connection Uniform Resource Identifiers (URIs) with embedded plaintext passwords. This information can be exposed to an authenticated attacker with monitoring privileges via the /api/shovels endpoint or rabbitmqctl shovel_status command. This leads to the disclosure of sensitive credentials, potentially allowing unauthorized access to other systems.
Package: rabbitmq-server4.2 (Red Hat Hardened Images) - Will not fix
Package: rabbitmq-server4.3 (Red Hat Hardened Images) - Affected
VulDB
RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5 Shovel Plugin amqp_uri:remove_credentials information disclosure
vuldb·2026-09-23·CVSS 5.9
CVE-2026-67221 [MEDIUM] RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5 Shovel Plugin amqp_uri:remove_credentials information disclosure
A vulnerability classified as problematic was found in RabbitMQ up to 3.13.14/4.0.19/4.1.10/4.2.5. This issue affects the function amqp_uri:remove_credentials of the component Shovel Plugin. The manipulation results in information disclosure.
This vulnerability was named CVE-2026-67221. The attack may be performed from remote. There is no available exploit.
Upgrading the affected component is advised.
No detection rules found.
No public exploits indexed.
2026-09-23
Published