CVE-2026-66068

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, ?LOG_DEBUG("shutting down Shovel '~ts', ... Shovel state: ~tp", [Name, State]) formats the entire state map. The 'uris' field holds plaintext URIs after credentials_obfuscation:decrypt (called in rabbit_shovel_util:deobfuscated_uris/2). No format_status/1,2 callback exists in rabbit_shovel_worker to redact it. Triggered when an autodelete shovel (src-delete-after = N) completes. With DEBUG logging enabled, autodelete-shovel completion writes the full shovel state map , including decrypted amqp://user:password@host/ URIs , to the broker log file. Preconditions include Shovel plugin enabled with URI-embedded credentials DEBUG log level (non-default) Autodelete shovel configuration Attacker has log read access. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0.

• CWE-532

• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.2.6
• https://github.com/rabbitmq/rabbitmq-server/releases/tag/v4.3.0
• https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-9wm4-9m6g-w38x

Published

Sep 23, 2026

Last Modified

Sep 24, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66062SvelteKit is a framework for rapidly developing robust, perf…5.3
• CVE-2026-66063goshs is a feature-rich single-binary file server for red te…6.5
• CVE-2026-66064goshs is a feature-rich single-binary file server for red te…5.3
• CVE-2026-66065Ouroboros is a local-first runtime for AI coding agents that…8.4
• CVE-2026-66066Action Pack is a framework for handling and responding to we…9.5
• CVE-2026-66067RabbitMQ is a messaging and streaming broker. Prior to versi…6
• CVE-2026-66069RabbitMQ is a messaging and streaming broker. Prior to versi…2.3
• CVE-2026-6607A security vulnerability has been detected in lm-sys fastcha…5.5
• CVE-2026-66070RabbitMQ is a messaging and streaming broker. Prior to versi…7.6
• CVE-2026-66071RabbitMQ is a messaging and streaming broker. From 3.13.0 un…6
• CVE-2026-66072RabbitMQ is a messaging and streaming broker. Prior to versi…6
• CVE-2026-66073RabbitMQ is a messaging and streaming broker. From 3.13.0 un…6