Inclusion of Sensitive Information in Log Files in RabbitMQ Server - CVE-2026-66068
Published: July 9, 2026 / Updated: September 28, 2026
Vulnerability identifier: #VU137233
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-66068
CWE-ID: CWE-532
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to disclose sensitive information.
The vulnerability exists due to insertion of sensitive information into log files in rabbit_shovel_behaviour.erl when processing autodelete shovel completion with DEBUG logging enabled. A local privileged user can read the broker log file to disclose sensitive information.
The issue exposes decrypted amqp URIs containing embedded credentials in the logged shovel state map, and requires the shovel plugin with URI-embedded credentials and an autodelete shovel configuration.
Affected software
RabbitMQ Server
How to mitigate CVE-2026-66068
Install security update from vendor's website.
RabbitMQ Server - addressed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6