Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

RabbitMQ logs usernames and passwords in clear text

CVE-2025-50200 · published 1 year ago
Summary

Versions of RabbitMQ up to 3.13.7 record the login information from HTTP requests in their logs, showing the user name and password in a form that can be easily decoded. This could let an observer steal credentials and access the messaging system. Update RabbitMQ to version 4.0.8 or later to stop the logging of these credentials.

What to do
  • Update broadcom rabbitmq_server to version 4.0.8 or later.
Affected software
VendorProductAffected versions
broadcom rabbitmq_server < 4.0.8
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*
Original advisory text
RabbitMQ Node can log Basic Auth header from an HTTP request
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published19 Jun 2025
Updated29 Oct 2026
First seen7 Mar 2026
Sources
CVE-2025-50200 · NVD
CVE-2025-50200 · OSV
GHSA-gh3x-4x42-fvq8 · GHSA
Track software like this
Free during beta