Detections
Analytics

RabbitMQ 4.0.x < 4.0.23 / 4.1.x < 4.1.14 / 4.2.x < 4.2.9 / 4.3.x < 4.3.3 Shovel Credential Disclosure via Crash Report

medium Nessus Plugin ID 362549

Synopsis

The RabbitMQ installed on the remote host is affected by an information disclosure vulnerability.

Description

The version of RabbitMQ installed on the remote host is 4.0.x prior to 4.0.23, or 4.1.x prior to 4.1.14, or 4.2.x prior to 4.2.9, or 4.3.x prior to 4.3.3. It is, therefore, affected by an information disclosure vulnerability:

 - The Shovel worker processes do not implement the format_status callback. When a Shovel worker crashes, for example after a network partition or a connection failure, the Erlang error handler writes the full process state to the node log. That state includes the plaintext source and destination URIs with their embedded passwords. An actor with access to the node log files can therefore recover Shovel credentials. (CVE-2026-67406)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to RabbitMQ version 4.0.23, 4.1.14, 4.2.9, 4.3.3, or later.

See Also

http://www.nessus.org/u?6773218f

Plugin Details

Severity: Medium

ID: 362549

File Name: rabbitmq_shovel_cred_leak_4_0_23.nasl

Version: 1.1

Type: Local

Agent: windows, macosx, unix

Family: Misc.

Published: 10/2/2026

Updated: 10/2/2026

Configuration: Enable paranoid mode, Enable thorough checks (optional)

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.43

CVSS v2

Risk Factor: Medium

Base Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-67406

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

CVSS v4

Risk Factor: Medium

Base Score: 4.6

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Vulnerability Information

CPE: cpe:/a:pivotal_software:rabbitmq, cpe:/a:vmware:rabbitmq

Required KB Items: installed_sw/RabbitMQ, Settings/ParanoidReport

Patch Publication Date: 7/23/2026

Vulnerability Publication Date: 7/23/2026

Reference Information

CVE: CVE-2026-67406