CVE-2025-50200
RabbitMQ Node can log Basic Auth header from an HTTP request
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
RabbitMQ Node can log Basic Auth header from an HTTP request
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
- Record
CVE-2025-50200- CVSS 4.0
- 6.7 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-532
- Updated
- 2026-11-02
EUVDEUVD-2025-18689
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
- Record
EUVD-2025-18689- CVSS 4.0
- 6.7 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
- Record
CVE-2025-50200- CVSS 4.0
- 6.7 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSV
RabbitMQ Node can log Basic Auth header from an HTTP request
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
- Record
CVE-2025-50200- CVSS 4.0
- 6.7 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-532
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-50200
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
- Record
DEBIAN-CVE-2025-50200- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-50200
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
- Record
UBUNTU-CVE-2025-50200- CVSS 4.0
- 6.7 Medium
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVAZL-64166 No score
CVE-2025-50200 affecting package rabbitmq-server for versions less than 3.13.7-3
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
- Record
AZL-64166- Updated
- 2026-11-05
OSVBIT-rabbitmq-2025-50200 No score
RabbitMQ Node can log Basic Auth header from an HTTP request
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
- Record
BIT-rabbitmq-2025-50200- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15410-1 No score
erlang-rabbitmq-client-3.13.7-5.1 on GA media
These are all security issues fixed in the erlang-rabbitmq-client-3.13.7-5.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15410-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:03234-1 No score
Security update for rabbitmq-server313
This update for rabbitmq-server313 fixes the following issues:
- CVE-2025-50200: Fixed logging of Basic Auth header from an HTTP request (bsc#1245105)
- Fixed bad logrotate configuration allowing potential escalation from rabbitmq to root (bsc#1246091)
- Record
SUSE-SU-2025:03234-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:3809-1 No score
Security update for rabbitmq-server
This update for rabbitmq-server fixes the following issues:
- CVE-2025-50200: prevented logging of Basic Auth header from HTTP requests (bsc#1245105)
- fixed a bad logrotate configuration that allowed escalation from rabbitmq to root, /var/log/rabbitmq ownership is now 750 (bsc#1246091)
- Record
SUSE-SU-2025:3809-1- Updated
- 2026-11-02
OSVUSN-7763-1 No score
rabbitmq-server vulnerability
It was discovered that RabbitMQ Server incorrectly included authorization headers when logging. A local attacker could possibly use this issue to obtain sensitive information.
- Record
USN-7763-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rabbitmq-serverAzure Linux:3 |
before 3.13.7-3 | 3.13.7-3 |
rabbitmqBitnami |
before 4.0.8 | 4.0.8 |
rabbitmq-serverDebian:13 |
before 4.0.5-6+deb13u2, plus listed versions 4.0.5-64.0.5-6+deb13u1 |
4.0.5-6+deb13u2 |
rabbitmq-serverDebian:14 |
before 4.0.5-9, plus listed versions 4.0.5-64.0.5-8 |
4.0.5-9 |
rabbitmq-server313SUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 3.13.1-150600.13.11.1 | 3.13.1-150600.13.11.1 |
rabbitmq-server313SUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 3.13.1-150600.13.11.1 | 3.13.1-150600.13.11.1 |
rabbitmq-server313openSUSE:Leap 15.6 |
before 3.13.1-150600.13.11.1 | 3.13.1-150600.13.11.1 |
rabbitmq-serverSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 3.8.11-150300.3.22.2 | 3.8.11-150300.3.22.2 |
rabbitmq-serverSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 3.8.11-150300.3.22.2 | 3.8.11-150300.3.22.2 |
rabbitmq-serveropenSUSE:Leap 15.6 |
before 3.8.11-150300.3.22.2 | 3.8.11-150300.3.22.2 |
rabbitmq-serverUbuntu:25.04 |
before 4.0.5-2ubuntu2.1, plus listed versions 3.12.1-1ubuntu24.0.5-2ubuntu14.0.5-2ubuntu2 |
4.0.5-2ubuntu2.1 |
rabbitmq-serveropenSUSE:Tumbleweed |
before 3.13.7-5.1 | 3.13.7-5.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-50200 is a medium vulnerability (CVSS 6.7) in Broadcom Rabbitmq Server, published June 19, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.22%, the 12th percentile. Fixed in rabbitmq-server 3.13.7-3.
References
github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gh3x-4x42-fvq8
nvd.nist.gov/vuln/detail/CVE-2025-50200
security-tracker.debian.org/tracker/CVE-2025-50200
suse.com/support/update/announcement/2025/suse-su-202503234-1
bugzilla.suse.com/1245105