Rabbitmq server: RabbitMQ is a messaging and streaming broker. (CVE-2026-67406)
Description
RabbitMQ versions from 4.0.0 up to but not including 4.3.3, 4.2.9, 4.1.14, and 4.0.23 have a vulnerability in the Shovel feature where crash reports can expose plaintext AMQP credentials. This occurs because the shovel worker genserver processes do not implement the formatstatus/2 callback, causing the OTP SASL error handler to log full process state including unencrypted passwords and URIs when these processes crash. The issue is fixed in versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23.
CVSS v4.0
Affected software
pkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra-legacy/xenialpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/bionicpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=esm-infra/focalpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=jammypkg:deb/ubuntu/rabbitmq-server?arch=source&distro=noblepkg:deb/ubuntu/rabbitmq-server?arch=source&distro=stonkingpkg:deb/ubuntu/rabbitmq-server?arch=source&distro=resoluteRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The RabbitMQ Shovel worker genserver processes lack implementation of the formatstatus/2 callback. When these processes crash, the OTP SASL error handler logs the entire process state, which includes plaintext AMQP passwords and URIs. This results in automatic exposure of credentials in error logs without requiring special configuration, as SASL error reports are always active. The vulnerability affects RabbitMQ versions from 4.0.0 until fixed in 4.3.3, 4.2.9, 4.1.14, and 4.0.23.
Potential Impact
Plaintext AMQP credentials (usernames and passwords) can be exposed in RabbitMQ error logs during shovel worker crashes, which are common during network partitions or connection failures. This exposure can lead to credential compromise if error logs are accessed by unauthorized parties. No special logging configuration is needed for this exposure to occur.
Mitigation Recommendations
This vulnerability is fixed in RabbitMQ versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23. Users should upgrade to one of these fixed versions to remediate the issue. Until upgraded, monitoring and restricting access to RabbitMQ error logs is advised to reduce risk of credential exposure.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-67406
- Osv Schema Version
- 1.7.0
- Ecosystems
- ["Ubuntu:Pro:16.04:LTS","Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:26.10","Ubuntu:26.04:LTS"]
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad3f5a72cdf04f6566627dc
Added to database: 10/17/2026, 22:24:39 UTC
Last enriched: 10/17/2026, 23:56:08 UTC
Last updated: 10/17/2026, 23:56:08 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.