Information Disclosure in RabbitMQ Messaging Broker
CVE-2026-66068
5.6MEDIUM
What is CVE-2026-66068?
A vulnerability in RabbitMQ allows sensitive information to be exposed through DEBUG logging when certain conditions are met. Specifically, the autodelete shovel configuration logs the entire state map, including plaintext URIs that contain embedded credentials, to the broker log file. This happens when the DEBUG log level is enabled, which is not a default setting. Attackers with access to the logs can retrieve sensitive information, making it crucial for users to upgrade to the fixed versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 to mitigate this risk.
Affected Version(s)
rabbitmq-server >= 3.13.0, < 3.13.15 < 3.13.0, 3.13.15
rabbitmq-server >= 4.0.0, < 4.0.20 < 4.0.0, 4.0.20
rabbitmq-server >= 4.1.0, < 4.1.11 < 4.1.0, 4.1.11