RabbitMQ's Shovel worker genserver processes lack implementation of the formatstatus/2 callback, leading to unformatted crash reports that include plaintext AMQP URIs and passwords in error logs. When these processes crash, the OTP SASL error handler logs the full process state, exposing sensitive credentials. This vulnerability affects multiple version branches from 4.0.0 up to but not including the fixed versions 4.0.23, 4.1.14, 4.2.9, and 4.3.3. No special logging configuration is needed as SASL error reports are always active. The flaw is addressed by fixes in the specified versions.

Sensitive AMQP credentials, including usernames and passwords in plaintext, can be exposed in error logs when the Shovel worker crashes. This exposure can lead to unauthorized access if logs are accessed by attackers or unauthorized personnel. The vulnerability is medium severity with a CVSS 4.6 score, reflecting network attack vector, low attack complexity, and partial attack requirements. There is no indication of active exploitation in the wild.

Upgrade rabbitmq-server to one of the fixed versions: 4.3.3, 4.2.9, 4.1.14, or 4.0.23. This patch corrects the formatting of crash reports to prevent plaintext credential exposure. No additional configuration changes are required to mitigate this issue once patched.