CVE-2025-50200: RabbitMQ Node can log Basic Auth header from an HTTP request
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-50200?
CVE-2025-50200 is classified as a high-severity vulnerability due to the exposure of sensitive authorization headers in plaintext logs.
How do I fix CVE-2025-50200?
To fix CVE-2025-50200, upgrade RabbitMQ to version 3.13.8 or later to ensure authorization headers are not logged in plaintext.
What versions of RabbitMQ are affected by CVE-2025-50200?
CVE-2025-50200 affects RabbitMQ versions 3.13.7 and prior.
What data is exposed due to CVE-2025-50200?
CVE-2025-50200 exposes authorization headers in plaintext, encoded in base64, in RabbitMQ logs.
How can I secure my RabbitMQ installation against CVE-2025-50200?
Securing your RabbitMQ installation against CVE-2025-50200 involves upgrading to the secure version and implementing logging controls to avoid sensitive data exposure.