CVE-2026-67221
RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
- Record
CVE-2026-67221- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-312
- Updated
- 2026-11-02
EUVDEUVD-2026-85666
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
- Record
EUVD-2026-85666- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
NVD
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
- Record
CVE-2026-67221- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
OSV
RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
- Record
CVE-2026-67221- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-312
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-67221
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
- Record
DEBIAN-CVE-2026-67221- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2026:67552
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:67552- CVSS 3.1
- 8.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-67221
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
- Record
UBUNTU-CVE-2026-67221- CVSS 4.0
- 5.9 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVAZL-105738 No score
CVE-2026-67221 affecting package rabbitmq-server for versions less than 3.13.7-10
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
- Record
AZL-105738- Updated
- 2026-11-05
OSVBIT-rabbitmq-2026-67221 No score
RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
- Record
BIT-rabbitmq-2026-67221- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rabbitmq-serverAzure Linux:3 |
before 3.13.7-10 | 3.13.7-10 |
rabbitmqBitnami |
3.13.0 up to 3.13.15, 4.0.0 up to 4.0.20, 4.1.0 up to 4.1.11, 4.2.0 up to 4.2.6 | 3.13.154.0.204.1.114.2.6 |
rabbitmq-serverDebian:12 |
All versions, plus listed versions 3.10.8-1.13.10.8-1.1+deb12u13.10.8-23.10.8-33.10.8-4 Show 24 moreShow less3.12.1-13.12.1-1.14.0.5-14.0.5-104.0.5-114.0.5-124.0.5-134.0.5-144.0.5-24.0.5-34.0.5-44.0.5-54.0.5-64.0.5-84.0.5-94.3.0-14.3.0-24.3.0-34.3.2-14.3.2-24.3.2-34.3.2-44.3.2-54.3.6-1 |
None known |
rabbitmq-serverDebian:13 |
All versions, plus listed versions 4.0.5-104.0.5-114.0.5-124.0.5-134.0.5-14 Show 14 moreShow less4.0.5-64.0.5-6+deb13u14.0.5-6+deb13u24.0.5-84.0.5-94.3.0-14.3.0-24.3.0-34.3.2-14.3.2-24.3.2-34.3.2-44.3.2-54.3.6-1 |
None known |
rabbitmq-serverDebian:14 |
before 4.3.0-2, plus listed versions 4.0.5-104.0.5-114.0.5-124.0.5-134.0.5-14 Show 4 moreShow less4.0.5-64.0.5-84.0.5-94.3.0-1 |
4.3.0-2 |
rabbitmq-server4.3Red Hat:hummingbird:1 From an advisory covering 54 CVEs |
before 0:4.3.6-1.hum1 | 0:4.3.6-1.hum1 |
rabbitmq-serverUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 3.5.4-13.5.4-33.5.4-3.13.5.7-13.5.7-1ubuntu0.16.04.1 Show 5 moreShow less3.5.7-1ubuntu0.16.04.23.5.7-1ubuntu0.16.04.43.5.7-1ubuntu0.16.04.4+esm13.5.7-1ubuntu0.16.04.4+esm23.5.7-1ubuntu0.16.04.4+esm3 |
None known |
rabbitmq-serverUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 3.6.10-13.6.10-1ubuntu0.13.6.10-1ubuntu0.33.6.10-1ubuntu0.43.6.10-1ubuntu0.53.6.10-1ubuntu0.5+esm1 |
None known |
rabbitmq-serverUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 3.7.8-4ubuntu23.7.18-13.8.2-0ubuntu13.8.2-0ubuntu1.13.8.2-0ubuntu1.2 Show 8 moreShow less3.8.2-0ubuntu1.33.8.2-0ubuntu1.43.8.2-0ubuntu1.53.8.3-0ubuntu0.13.8.3-0ubuntu0.23.8.3-0ubuntu0.33.8.3-0ubuntu0.3+esm13.8.3-0ubuntu0.3+esm2 |
None known |
rabbitmq-serverUbuntu:22.04:LTS |
All versions, plus listed versions 3.8.9-3ubuntu13.9.8-13.9.8-23.9.8-33.9.8-5 Show 8 moreShow less3.9.8-63.9.13-13.9.13-1ubuntu0.22.04.13.9.13-1ubuntu0.22.04.23.9.27-0ubuntu0.13.9.27-0ubuntu0.23.9.27-0ubuntu0.53.9.27-0ubuntu0.6 |
None known |
rabbitmq-serverUbuntu:24.04:LTS |
All versions, plus listed versions 3.12.1-13.12.1-1ubuntu13.12.1-1ubuntu1.23.12.1-1ubuntu1.43.12.1-1ubuntu1.63.12.1-1ubuntu1.7 |
None known |
rabbitmq-serverUbuntu:26.04:LTS |
All versions, plus listed versions 4.0.5-8ubuntu24.0.5-10ubuntu14.0.5-10ubuntu24.0.5-10ubuntu34.0.5-10ubuntu44.0.5-10ubuntu54.0.5-10ubuntu5.14.0.5-10ubuntu5.2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-67221 is a medium vulnerability (CVSS 5.9) in Broadcom Rabbitmq Server, published September 22, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.19%, the 8th percentile. Fixed in rabbitmq-server 3.13.7-10.
References
github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-x5h5-588r-cv55
nvd.nist.gov/vuln/detail/CVE-2026-67221
security-tracker.debian.org/tracker/CVE-2026-67221
access.redhat.com/errata/RHSA-2026:67552
Show 194 moreShow less
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67552.json
bugzilla.redhat.com/show_bug.cgi?id=2482215
cve.org/CVERecord?id=CVE-2026-44839
ubuntu.com/security/CVE-2026-67221
Left out here: 124 references. The JSON record has them.