CVE-2025-50200 describes a vulnerability in RabbitMQ server (<=3.13.7) where authorization headers containing base64-encoded credentials are logged in plaintext. When clients use HTTP basic authentication to query the RabbitMQ API, all request headers including the Authorization header are logged. Since the Authorization header encodes username and password in base64, an attacker with access to logs can decode these credentials and potentially gain system control depending on the credentials obtained. This vulnerability is classified under CWE-532 (Insertion of Sensitive Information into Log File). The vulnerability has been patched in RabbitMQ version 4.0.8.

Sensitive credentials (username and password) are exposed in logs in base64-encoded form, which can be trivially decoded. If an attacker gains access to these logs, they can retrieve valid credentials and potentially gain unauthorized access or control over the RabbitMQ system. The CVSS 4.0 score is 6.7 (medium severity), reflecting local attack vector with low attack complexity but requiring high privileges to exploit.

Upgrade RabbitMQ to version 4.0.8 or later, where this logging behavior has been corrected. Until upgrading, restrict access to RabbitMQ logs to trusted personnel only to prevent credential leakage. No other vendor advisory mitigation instructions are provided.