CVE-2026-67221: RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords

Q: Which deployments are exposed to credential disclosure?

Exposure requires the Shovel plugin to be in use and an AMQP 1.0 shovel to be configured with credentials embedded in its connection URI. AMQP 0-9-1 shovels remove credentials before storing the URI and are not the affected path described here.

Q: What access does an attacker need to retrieve the password?

The attacker needs access to shovel status and the monitoring tag. The affected stored URI can be viewed through GET /api/shovels or the rabbitmqctl shovel_status command.

Q: What should be done if an affected instance cannot be upgraded immediately?

Avoid configuring AMQP 1.0 shovels with URI-embedded credentials and restrict access to users with the monitoring tag. Credentials previously embedded in affected shovel URIs should be treated as exposed and rotated.

Q: Which versions contain the fix?

The issue is fixed in RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Published Sep 23, 2026

Updated

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET /api/shovels and via rabbitmqctl shovelstatus. Preconditions include The Shovel plugin must be in use with AMQP 1.0 shovels configured using URI-embedded credentials. Reading the exposed status requires the monitoring tag.. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

Affected Software

1 affected component

RabbitMQ RabbitMQ<3.13.15, <4.0.20, <4.1.11, <4.2.6, <4.3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 3.13.15
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.0.20
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.1.11
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.2.6
Upgrade
Upgrade RabbitMQ to a version that resolves this vulnerability.
Fixed in 4.3.0

Event History

Sep 23, 2026

CVE Published

via MITRE·08:48 PM

Data Sourced

via MITRE·08:48 PM

DescriptionWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to credential disclosure?

Exposure requires the Shovel plugin to be in use and an AMQP 1.0 shovel to be configured with credentials embedded in its connection URI. AMQP 0-9-1 shovels remove credentials before storing the URI and are not the affected path described here.

What access does an attacker need to retrieve the password?