CVE-2026-66068: RabbitMQ Shovel Information Disclosure

CVE-2026-66068 Overview

CVE-2026-66068 affects RabbitMQ, an open-source messaging and streaming broker. The vulnerability exposes plaintext credentials in broker log files when the Shovel plugin operates under DEBUG log level. When an autodelete shovel completes, the ?LOG_DEBUG macro serializes the full shovel state map, including decrypted amqp://user:password@host/ Uniform Resource Identifiers (URIs). The rabbit_shovel_worker module lacks a format_status/1,2 callback to redact sensitive fields. This information disclosure issue is tracked under [CWE-532: Insertion of Sensitive Information into Log File].

Critical Impact
An attacker with log read access can recover AMQP broker credentials embedded in URIs after autodelete shovel completion, enabling downstream access to messaging infrastructure.

Affected Products

RabbitMQ versions prior to 3.13.15
RabbitMQ 4.0.x prior to 4.0.20, 4.1.x prior to 4.1.11, and 4.2.x prior to 4.2.6
RabbitMQ Shovel plugin with URI-embedded credentials

Discovery Timeline

2026-09-23 - CVE-2026-66068 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-66068

Vulnerability Analysis

The flaw resides in rabbit_shovel_worker, the Erlang module that manages Shovel plugin worker processes. When an autodelete shovel configured with src-delete-after = N completes its work, the worker logs a shutdown message via ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, State]). The ~tp format specifier serializes the entire state term, including the uris field.

That uris field contains AMQP URIs that have already passed through credentials_obfuscation:decrypt, invoked in rabbit_shovel_util:deobfuscated_uris/2. As a result, plaintext credentials embedded in URIs land in broker log files. Erlang's OTP provides a format_status/1,2 callback so processes can sanitize state before logging, but rabbit_shovel_worker does not implement it.

Root Cause

The root cause is missing state redaction in a gen_statem-style worker combined with an overly broad debug log statement. Credentials are decrypted for legitimate use inside the worker but are never scrubbed before the state term reaches the logging pipeline.

Attack Vector

Exploitation requires a specific configuration: the Shovel plugin must be enabled, shovels must use URI-embedded credentials, DEBUG logging must be enabled (non-default), and at least one autodelete shovel must run to completion. An attacker with read access to broker log files, whether local, via a log-forwarding pipeline, or through a compromised log aggregation backend, can extract the disclosed credentials and reuse them against the broker or upstream/downstream AMQP endpoints.

No direct exploitation code is required. The vulnerability manifests through routine log inspection. See the GitHub Security Advisory GHSA-9wm4-9m6g-w38x for full technical details.

Detection Methods for CVE-2026-66068

Indicators of Compromise

Broker log entries containing the string shutting down Shovel alongside amqp:// or amqps:// URIs that include a user:password@ component.
Presence of uris field values in RabbitMQ log lines that reveal decrypted credentials.
Unexpected access or downloads of RabbitMQ log files by non-administrative accounts.

Detection Strategies

Grep or SIEM searches across RabbitMQ log destinations for regex patterns matching amqp[s]?://[^:]+:[^@]+@.
Configuration audits identifying nodes running with log.default.level = debug and the Shovel plugin enabled.
Inventory of shovel definitions using URI-embedded credentials rather than credential references.

Monitoring Recommendations

Forward RabbitMQ logs to a centralized log analytics platform and alert on AMQP URI patterns containing credentials.
Monitor file system access events on rabbit@*.log files to identify unauthorized readers.
Track configuration drift on RabbitMQ log level settings to detect DEBUG being enabled in production.

How to Mitigate CVE-2026-66068

Immediate Actions Required

Upgrade RabbitMQ to a fixed release: 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0.
Rotate any AMQP credentials that appeared in shovel URIs while DEBUG logging was active on affected nodes.
Purge or restrict access to historical broker log files that may contain exposed credentials.

Patch Information

The issue is fixed in RabbitMQ 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. Release notes and binaries are available at GitHub RabbitMQ v4.2.6 Release and GitHub RabbitMQ v4.3.0 Release. The fix adds credential redaction to the Shovel worker state before it reaches the logger.

Workarounds

Set the RabbitMQ log level back to the default (info) on all nodes where the Shovel plugin is enabled until patching completes.
Replace URI-embedded credentials in shovel definitions with credential references or client certificates.
Restrict log file access to a minimal set of operators and ensure log forwarders authenticate to trusted destinations only.

bash

# Configuration example: disable DEBUG logging in rabbitmq.conf
log.default.level = info
log.file.level = info
log.console.level = info