CVE-2026-67406 Overview
CVE-2026-67406 is an information disclosure vulnerability in RabbitMQ Shovel. The flaw affects RabbitMQ versions 4.0.0 through 4.3.2, 4.2.8, 4.1.13, and 4.0.22. Shovel worker genserver processes do not implement the format_status/2 callback. When these processes crash, the OTP SASL error handler writes the full process state to the error log. The logged state includes plaintext AMQP passwords and URIs in the form amqp://user:password@host. The issue maps to CWE-200: Exposure of Sensitive Information. RabbitMQ fixed the issue in versions 4.3.3, 4.2.9, 4.1.14, and 4.0.23.
Critical Impact
Shovel worker crashes automatically write plaintext upstream and downstream broker credentials to error logs without requiring debug logging or any special configuration.
Affected Products
- RabbitMQ Server 4.0.0 through 4.0.22
- RabbitMQ Server 4.1.0 through 4.1.13
- RabbitMQ Server 4.2.0 through 4.2.8 and 4.3.0 through 4.3.2
Discovery Timeline
- 2026-09-25 - CVE-2026-67406 published to NVD
- 2026-09-28 - Last updated in NVD database
Technical Details for CVE-2026-67406
Vulnerability Analysis
RabbitMQ Shovel is a plugin that moves messages between brokers. Each Shovel is implemented as an Erlang/OTP genserver process. The worker stores deobfuscated connection URIs in its process state so it can reconnect to upstream and downstream brokers. These URIs embed credentials using the standard amqp://user:password@host syntax.
OTP genserver processes can define an optional format_status/2 callback. This callback redacts or transforms sensitive data before the runtime logs process state. The Shovel worker does not implement this callback. When the worker crashes due to a network partition, broker disconnect, or protocol error, the SASL error handler serializes the entire genserver state to the log. SASL error reports are enabled by default and run independently of debug logging. Any operator or log aggregator with access to the error log receives the plaintext credentials.
Root Cause
The root cause is a missing format_status/2 sanitization callback in the Shovel worker module. OTP relies on this callback to scrub secrets from crash reports. Without it, the default behavior logs the full term representation of the process dictionary and state record.
Attack Vector
Exploitation requires high privileges and does not involve direct network interaction with the vulnerability. An attacker with read access to RabbitMQ error logs, crash dumps, or downstream log pipelines obtains cleartext broker credentials. Those credentials can then be reused to publish, consume, or administer messages on the linked brokers. Network conditions that trigger Shovel crashes, such as transient partitions, accelerate credential exposure.
No verified exploit code is published. See the GitHub Security Advisory GHSA-q44f-9vc5-grh7 for additional technical detail.
Detection Methods for CVE-2026-67406
Indicators of Compromise
- Error log or crash dump entries from the rabbit_shovel_worker module containing amqp:// or amqps:// URIs with embedded credentials.
- SASL =CRASH REPORT= entries referencing Shovel processes with full state terms.
- Unexpected authentications on upstream or downstream brokers using Shovel service accounts from new source addresses.
Detection Strategies
- Grep RabbitMQ log directories for the pattern amqp[s]?://[^:]+:[^@]+@ to surface exposed credentials in historical logs.
- Alert on any SASL crash report that includes the rabbit_shovel_worker module name.
- Correlate Shovel crash events with authentication events on linked brokers to identify credential reuse.
Monitoring Recommendations
- Forward RabbitMQ broker logs to a central SIEM and tag entries containing AMQP URI patterns as sensitive.
- Monitor the frequency of Shovel worker restarts, since repeated crashes amplify disclosure risk.
- Audit who has read access to log files, log shipping buckets, and crash dump storage on broker hosts.
How to Mitigate CVE-2026-67406
Immediate Actions Required
- Upgrade RabbitMQ to version 4.3.3, 4.2.9, 4.1.14, or 4.0.23 depending on your release branch.
- Rotate all Shovel upstream and downstream credentials that may have been written to logs.
- Purge or restrict access to existing RabbitMQ error logs and crash dumps that could contain plaintext URIs.
Patch Information
The RabbitMQ maintainers released fixed versions on GitHub. Install the updates from the RabbitMQ 4.3.3 release notes or the RabbitMQ 4.2.9 release notes. The fix adds a format_status/2 callback to the Shovel worker so SASL crash reports no longer include plaintext credentials.
Workarounds
- Restrict filesystem permissions on rabbit@<host>.log, SASL log files, and Erlang crash dumps to the broker service account only.
- Scrub AMQP credentials from log aggregation pipelines using redaction rules before indexing.
- Use TLS client certificates or external authentication backends where possible to reduce reliance on password-bearing URIs.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
