CVE-2025-50200: RabbitMQ Information Disclosure Flaw

CVE-2025-50200 Overview

CVE-2025-50200 is an information disclosure vulnerability in RabbitMQ, a widely-used messaging and streaming broker. The vulnerability exists in versions 3.13.7 and prior, where RabbitMQ improperly logs HTTP authorization headers in plaintext (base64 encoded) when the API is queried with HTTP/HTTPS using basic authentication. This logging behavior exposes sensitive credentials that can be easily decoded, potentially allowing attackers with log file access to obtain system control depending on the compromised credentials.

Critical Impact
Attackers with access to RabbitMQ log files can extract base64-encoded credentials, decode them trivially, and potentially gain unauthorized access to the messaging broker and connected systems.

Affected Products

Broadcom RabbitMQ Server versions 3.13.7 and prior
RabbitMQ installations using HTTP/HTTPS API with basic authentication
Systems with accessible RabbitMQ log files

Discovery Timeline

June 19, 2025 - CVE-2025-50200 published to NVD
August 6, 2025 - Last updated in NVD database

Technical Details for CVE-2025-50200

Vulnerability Analysis

This vulnerability falls under CWE-532 (Insertion of Sensitive Information into Log File), a common information disclosure weakness. When administrators or applications query the RabbitMQ API using HTTP or HTTPS with basic authentication, the server logs all request headers including the Authorization header. Basic authentication credentials are transmitted as base64-encoded username:password strings, which are trivially reversible. Any user or attacker with read access to these log files can extract and decode the credentials.

The local attack vector means that exploitation requires existing access to the system hosting RabbitMQ, either through legitimate means or prior compromise. However, the impact is significant as compromised RabbitMQ credentials could provide full administrative access to the messaging infrastructure, enabling attackers to intercept messages, modify routing, or disrupt critical business communications.

Root Cause

The root cause is improper handling of sensitive data in the logging subsystem. RabbitMQ's HTTP API handler logs complete request headers for debugging and audit purposes without filtering or masking the Authorization header. Base64 encoding provides no security as it is an encoding scheme, not encryption, and can be decoded instantly without any key material.

Attack Vector

The attack requires local access to the RabbitMQ server's log files. An attacker who has gained read access to the logging directory—whether through a separate vulnerability, misconfigured permissions, insider access, or log aggregation systems—can search for authorization headers in the logs. Once found, the base64-encoded credentials can be decoded using any standard base64 decoder. The attacker can then authenticate to the RabbitMQ API with the stolen credentials.

The exploitation flow involves:

Obtaining read access to RabbitMQ log files
Searching for HTTP request logs containing Authorization: Basic headers
Extracting the base64-encoded credential string
Decoding the base64 string to reveal username:password in plaintext
Using the credentials to authenticate to the RabbitMQ management API

Detection Methods for CVE-2025-50200

Indicators of Compromise

Unexpected read access to RabbitMQ log files from unauthorized users or processes
Authentication events from unusual IP addresses or at unusual times
Log file access patterns indicating bulk reading or searching behavior
API access using credentials that have not been recently legitimately used

Detection Strategies

Monitor file system access to RabbitMQ log directories using auditd or similar tools
Implement alerting on RabbitMQ API authentication from unexpected source IPs
Review access control lists on log files and log aggregation systems
Enable security monitoring on systems with access to centralized logging platforms

Monitoring Recommendations

Configure file integrity monitoring on RabbitMQ log directories
Implement network-based monitoring for RabbitMQ management API access patterns
Audit user accounts with read access to RabbitMQ server file systems
Review authentication logs for credential reuse or suspicious login patterns

How to Mitigate CVE-2025-50200

Immediate Actions Required

Upgrade RabbitMQ to version 4.0.8 or later where this issue has been patched
Rotate all credentials used for RabbitMQ HTTP API basic authentication
Review and restrict file system permissions on RabbitMQ log directories
Audit access to centralized logging systems that may contain RabbitMQ logs

Patch Information

Broadcom has released RabbitMQ version 4.0.8 which addresses this vulnerability by properly masking or excluding authorization headers from log output. Organizations should upgrade to this version as soon as possible. For detailed patch information, refer to the GitHub Security Advisory.

Workarounds

Restrict log file access permissions to only essential administrative accounts
Consider switching to alternative authentication methods such as certificate-based authentication (mTLS) that do not use basic auth headers
Implement log rotation with secure deletion to minimize the exposure window of sensitive data
Isolate RabbitMQ servers and limit network access to management APIs

bash

# Restrict RabbitMQ log directory permissions
chmod 700 /var/log/rabbitmq
chown rabbitmq:rabbitmq /var/log/rabbitmq

# Verify current permissions
ls -la /var/log/rabbitmq/