CVE-2026-67221 Overview
CVE-2026-67221 is a cleartext credential storage vulnerability [CWE-312] in RabbitMQ, an open source messaging and streaming broker. The AMQP 1.0 shovel stores the raw connection URI including embedded passwords, while the AMQP 0-9-1 shovel correctly strips credentials via amqp_uri:remove_credentials before storage. The exposed URI is returned by GET /api/shovels and rabbitmqctl shovel_status, making passwords visible to any user holding the monitoring tag. The issue affects deployments using the Shovel plugin with AMQP 1.0 shovels configured through URI-embedded credentials.
Critical Impact
Authenticated users with the monitoring tag can retrieve plaintext credentials for upstream AMQP 1.0 brokers, enabling lateral movement across connected messaging infrastructure.
Affected Products
- RabbitMQ Server versions prior to 3.13.15
- RabbitMQ Server 4.0.x prior to 4.0.20, 4.1.x prior to 4.1.11, and 4.2.x prior to 4.2.6
- Deployments using the Shovel plugin with AMQP 1.0 shovels and URI-embedded credentials
Discovery Timeline
- 2026-09-23 - CVE-2026-67221 published to NVD
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-67221
Vulnerability Analysis
The RabbitMQ Shovel plugin moves messages between brokers using either the AMQP 0-9-1 or AMQP 1.0 protocol. The AMQP 0-9-1 code path sanitizes connection strings by invoking amqp_uri:remove_credentials before persisting shovel state. The AMQP 1.0 code path omits this sanitization step and stores the raw URI, including any password embedded in the userinfo component. Any operator querying shovel status through the management HTTP API or the CLI receives the unredacted URI. The result is credential disclosure to accounts that were intentionally granted read-only observability rights.
Root Cause
The root cause is an inconsistency between the two shovel implementations. The AMQP 0-9-1 shovel treats the URI as sensitive and normalizes it prior to storage. The AMQP 1.0 shovel treats the URI as opaque configuration and retains it verbatim in the internal state visible through management interfaces. This maps to Cleartext Storage of Sensitive Information [CWE-312].
Attack Vector
Exploitation requires an authenticated RabbitMQ account with the monitoring tag. The attacker issues an HTTP GET request to /api/shovels on the management plugin endpoint, or runs rabbitmqctl shovel_status on a node they can access. The response body contains the source or destination URI in the form amqp://user:password@host for every configured AMQP 1.0 shovel. Recovered credentials can then be reused against the upstream or downstream broker, expanding access beyond the compromised RabbitMQ node.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-x5h5-588r-cv55 for the vendor's technical description.
Detection Methods for CVE-2026-67221
Indicators of Compromise
- Unexpected GET /api/shovels requests in the RabbitMQ management plugin access log, especially from accounts that do not normally interact with shovel state.
- Execution of rabbitmqctl shovel_status by operators outside standard change windows.
- Authentication events on upstream or downstream AMQP brokers originating from IP addresses that previously only queried RabbitMQ management APIs.
Detection Strategies
- Enumerate all configured AMQP 1.0 shovels and identify any whose source or destination URI contains embedded userinfo credentials.
- Enable and centralize RabbitMQ management HTTP access logs, then alert on reads of /api/shovels by accounts holding only the monitoring tag.
- Correlate broker authentication logs across environments to identify credential reuse patterns following shovel status queries.
Monitoring Recommendations
- Ingest RabbitMQ management API and rabbitmqctl audit events into a centralized logging pipeline with retention sufficient for retrospective review.
- Review the membership of the monitoring tag on a recurring basis and remove accounts that no longer require observability rights.
- Monitor for creation or modification of shovel definitions that include URI-embedded credentials rather than a src-uri referencing a credential-less endpoint.
How to Mitigate CVE-2026-67221
Immediate Actions Required
- Upgrade RabbitMQ to version 3.13.15, 4.0.20, 4.1.11, 4.2.6, or 4.3.0 as documented in the RabbitMQ Server Release 4.2.6 notes.
- Rotate every credential embedded in an existing AMQP 1.0 shovel URI, assuming disclosure to any account with the monitoring tag.
- Audit and reduce assignment of the monitoring tag to the minimum set of operational accounts.
Patch Information
The vendor fixed the issue in RabbitMQ Server 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0. Details are published in GitHub Security Advisory GHSA-x5h5-588r-cv55. After upgrade, redefine affected shovels so credentials are supplied outside the URI wherever supported.
Workarounds
- Replace URI-embedded credentials with shovel configuration options that pass authentication material separately from the connection URI.
- Temporarily disable AMQP 1.0 shovels that must use URI-embedded credentials until the upgrade is complete.
- Restrict network access to the RabbitMQ management HTTP endpoint so that only trusted operator networks can reach /api/shovels.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
