Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67221)
Description
RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0 contain a vulnerability where the AMQP 1.0 shovel stores the raw connection URI including the password, exposing sensitive credentials. This stored URI is accessible via the GET /api/shovels endpoint and the rabbitmqctl shovel_status command. The issue requires the Shovel plugin to be in use with AMQP 1.0 shovels configured using URI-embedded credentials, and reading the exposed status requires the monitoring tag. The vulnerability is fixed in the specified versions.
CVSS v4.0
Affected software
pkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=jammypkg:deb/ubuntu/rabbitmq-server?arch=source&distro=noblepkg:deb/ubuntu/rabbitmq-server?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
RabbitMQ's AMQP 1.0 shovel improperly stores the raw connection URI including embedded passwords, unlike the AMQP 0-9-1 shovel which removes credentials before storage. This results in sensitive credentials being exposed via the RabbitMQ management API and command-line shovel status interface. The vulnerability affects RabbitMQ versions prior to 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. Exploitation requires the Shovel plugin with AMQP 1.0 shovels configured with URI-embedded credentials and monitoring privileges to read the exposed data. The issue is addressed by removing credentials from stored URIs in the fixed versions.
Potential Impact
Sensitive credentials embedded in AMQP 1.0 shovel URIs can be exposed to users with monitoring privileges via API endpoints and command-line tools. This could lead to unauthorized access to RabbitMQ connections if monitoring access is compromised or granted to untrusted users. The vulnerability does not allow privilege escalation or remote code execution but leaks sensitive authentication data.
Mitigation Recommendations
Upgrade RabbitMQ to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 or later where the issue is fixed. Avoid using URI-embedded credentials in AMQP 1.0 shovels until patched. Restrict monitoring tag privileges to trusted users only to limit exposure of shovel status information.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-67221
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad3f5ac2cdf04f656662800
Added to database: 10/17/2026, 22:24:44 UTC
Last enriched: 10/18/2026, 00:04:50 UTC
Last updated: 10/18/2026, 00:04:50 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.