Skip to content

AMQP 1.0 shovel status exposes plaintext URI passwords

Moderate
ansd published GHSA-x5h5-588r-cv55 Jul 9, 2026

Software

rabbitmq-server

Affected versions

>= 3.13.0, < 3.13.15
>= 4.0.0, < 4.0.20
>= 4.1.0, < 4.1.11
>= 4.2.0, < 4.2.6

Patched versions

3.13.15
4.0.20
4.1.11
4.2.6

Description

Origin

This vulnerability was identified by Team RabbitMQ and/or other teams at Broadcom, not via a responsible disclosure from an external researcher.

Description

The AMQP 0-9-1 shovel calls amqp_uri:remove_credentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovel_status.

Preconditions

The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.

CVSS

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N (5.9, Moderate). Fixed in 3.13.15, 4.0.20, 4.1.11, 4.2.6, 4.3.0.

Severity

Moderate

CVE ID

No known CVE

Weaknesses

Cleartext Storage of Sensitive Information

The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere. Learn more on MITRE.