Critical Security Flaw in RabbitMQ Server: Plaintext Logging of Authorization Headers
Summary
UBUNTU-CVE-2025-50200: RabbitMQ is a messaging and streaming broker. Affects rabbitmq-server versions < 4.0.5-2ubuntu2.1. Fixed in 4.0.5-2ubuntu2.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
RabbitMQ is a widely used messaging and streaming broker that facilitates communication between applications. It supports various messaging protocols and is known for its reliability and flexibility. However, a vulnerability has been identified in versions 3.13.7 and earlier, where authorization headers are logged in plaintext, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from RabbitMQ's logging mechanism, which records HTTP/S requests, including authorization headers, in plaintext encoded in base64. This means that sensitive information, such as usernames and passwords, can be easily decoded by an attacker. If an unauthorized individual gains access to these logs, they could potentially take control of the system, depending on the credentials used. This issue has been addressed in version 4.0.8 of RabbitMQ.
How To Fix
Minimum fixed version
4.0.5-2ubuntu2.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade rabbitmq-serverTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the logs and ensure that sensitive information is not exposed. Additionally, consider using secure logging practices that do not log sensitive headers.
Conclusion
In summary, the RabbitMQ server has a critical vulnerability that logs authorization headers in plaintext, which can lead to unauthorized access. It is crucial to update to version 4.0.8 or later to mitigate this risk. Additionally, employing secure logging practices and monitoring tools like Vulert can enhance your application's security.
See every vulnerability recorded for rabbitmq-server →
FAQ
Versions 3.13.7 and earlier are affected by this vulnerability.
The main risk is that sensitive authorization information can be exposed, allowing unauthorized access to the system.
You can check your RabbitMQ version by running 'rabbitmq-server -v' in your terminal.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just a manifest file.
You can use the Vulert playground at Vulert Scanner without any signup to check if your application is affected by this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for rabbitmq-server.
