CVE-2026-66068— RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs
Quick assessment
Affected
rabbitmq rabbitmq-server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
RabbitMQ 是一个消息与流媒体代理服务器。在 3.13.15、4.0.20、4.1.11、4.2.6 和 4.3.0 之前的版本中， 语句会格式化并记录完整的 Shovel 状态映射。该状态映射中的 字段在通过 （由 调用）解密后，以明文形式存储 URI。 模块中不存在 或 回调函数来对这些敏感信息进行脱敏处理。 当自动删除型 Shovel（即配置了 的 Shovel）执行完成后，会触发此问题。若启用了 DEBUG 级别日志，Shovel 完成时将把完整的 Shovel 状态映射写入代理服务器日志文件，其中包
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66068
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RabbitMQ: Shovel DEBUG log of full state exposes decrypted URIs
Source: CVE Program / CVE List V5
Vulnerability Description
RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, State]) formats the entire state map. The 'uris' field holds plaintext URIs after credentials_obfuscation:decrypt (called in rabbit_shovel_util:deobfuscated_uris/2). No format_status/1,2 callback exists in rabbit_shovel_worker to redact it. Triggered when an autodelete shovel (src-delete-after = N) completes. With DEBUG logging enabled, autodelete-shovel completion writes the full shovel state map , including decrypted amqp://user:password@host/ URIs , to the broker log file. Preconditions include Shovel plugin enabled with URI-embedded credentials DEBUG log level (non-default) Autodelete shovel configuration Attacker has log read access. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
通过日志文件的信息暴露
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| rabbitmq | rabbitmq-server | >= 3.13.0, < 3.13.15 | - |
|
II. Public POCs for CVE-2026-66068
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66068
请登录查看更多情报信息。
Vendor Pages for CVE-2026-66068 (1)
Other References for CVE-2026-66068 (2)
-
Release RabbitMQ 4.3.0 · rabbitmq/rabbitmq-server · GitHub x_refsource_MISC
Same Patch Batch · rabbitmq · 2026-09-23 · 25 CVEs total
| CVE-2026-67404 | 9.2 CRITICAL | RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch |
| CVE-2026-67231 | 9.1 CRITICAL | RabbitMQ: Trust-store whitelist by Issuer+Serial only |
| CVE-2026-66079 | 8.2 HIGH | RabbitMQ: Pre-auth AMQP 1.0 array32 zero-width element DoS |
| CVE-2026-67232 | 8.2 HIGH | RabbitMQ: Web-MQTT decompression bomb |
| CVE-2026-66070 | 7.6 HIGH | RabbitMQ: CORS * reflects Origin with Allow-Credentials |
| CVE-2026-66077 | 7.3 HIGH | RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI |
| CVE-2026-67235 | 7.1 HIGH | RabbitMQ: AMQP 0-9-1 body assembly never validates accumulated size |
| CVE-2026-67238 | 7.1 HIGH | RabbitMQ: Atom-table exhaustion via reply-to queue name decoding |
| CVE-2026-67228 | 6.9 MEDIUM | RabbitMQ: Atom exhaustion: to_atom on runtime-parameter component |
| CVE-2026-67229 | 6.9 MEDIUM | RabbitMQ: Admin-only atom exhaustion: atomize_keys on vhost metadata |
| CVE-2026-67219 | 6.0 MEDIUM | RabbitMQ: Consistent-hash exchange unbounded weight |
| CVE-2026-67220 | 6.0 MEDIUM | RabbitMQ: JMS topic exchange erl_scan atom exhaustion |
| CVE-2026-66067 | 6.0 MEDIUM | RabbitMQ: Stream protocol skips per vhost per user connection limits |
| CVE-2026-66074 | 6.0 MEDIUM | RabbitMQ: ReDoS via management API ?name= filter |
| CVE-2026-66072 | 6.0 MEDIUM | RabbitMQ: Atom table exhaustion via stream `chunk_selector` |
| CVE-2026-66080 | 5.9 MEDIUM | RabbitMQ: Super-stream partitions unbounded allocation |
| CVE-2026-67221 | 5.9 MEDIUM | RabbitMQ: AMQP 1.0 shovel status exposes plaintext URI passwords |
| CVE-2026-67405 | 5.3 MEDIUM | RabbitMQ: CSWSH on Web-STOMP / Web-MQTT (no Origin validation) |
| CVE-2026-66069 | 2.3 LOW | RabbitMQ: Monitoring-tag DELETE of auth-attempt metrics |
| CVE-2026-66076 | 2.3 LOW | RabbitMQ: Cross-vhost quorum-queue status and stream tracking disclosure |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: rabbitmq-server
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same vendor: rabbitmq
-
CVE-2026-67420
RabbitMQ OAuth credential refresh retains revoked runtime ta -
CVE-2026-67419
RabbitMQ: Consecutive topic wildcards cause combinatorial ro -
CVE-2026-67421
RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth -
CVE-2026-67408
RabbitMQ: Stream Management Super-Stream Binding Keys Alloca -
CVE-2026-67406
RabbitMQ: Federation and Shovel Gen-Servers Lack format_stat
Same weakness: CWE-532
-
CVE-2025-71425
Contrast before 1.8.1 Information Disclosure via Logging -
CVE-2025-71423
Edgelesssys Contrast before 1.12.2 Workload Secrets Informat -
CVE-2026-85417
Incomplete property masking in the SANnav logging subsystem -
CVE-2026-14442
Information exposure vulnerability in the job scheduling com -
CVE-2026-14443
Incomplete log sanitization during bulk IPsec policy collect
V. Comments for CVE-2026-66068
No comments yet