Cleartext storage of sensitive information in RabbitMQ Server - CVE-2026-67221
Published: July 9, 2026 / Updated: September 28, 2026
Vulnerability identifier: #VU137244
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-67221
CWE-ID: CWE-312
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to cleartext storage of sensitive information in the AMQP 1.0 shovel status output when exposing shovel status via the management API or command-line status command. A remote privileged user can read stored connection URIs containing embedded credentials to disclose sensitive information.
The issue affects AMQP 1.0 shovels configured with URI-embedded credentials, and exploitation requires access to read shovel status.
Affected software
RabbitMQ Server
How to mitigate CVE-2026-67221
Install security update from vendor's website.
RabbitMQ Server - addressed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6