Description
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| rabbitmq | rabbitmq-server | <= 3.13.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rabbitmq-server | 4.0.5-9 | — |
| Debian 13 | rabbitmq-server | 4.0.5-6+deb13u2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 25.04 | rabbitmq-server | 4.0.5-2ubuntu2.1 | USN-7763-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | rabbitmq-server | 3.8.11-150300.3.22.2 | SUSE-SU-2025:3809-1 |
| SLES 15 SP7 | rabbitmq-server313 | 3.13.1-150600.13.11.1 | SUSE-SU-2025:03234-1 |
| SLES 15 SP6 | rabbitmq-server | 3.8.11-150300.3.22.2 | SUSE-SU-2025:3809-1 |
| SLES 15 SP6 | rabbitmq-server313 | 3.13.1-150600.13.11.1 | SUSE-SU-2025:03234-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rabbitmq-server | 3.13.7-5.1 | openSUSE-SU-2025:15410-1 |
| openSUSE Leap 15.6 | rabbitmq-server | 3.8.11-150300.3.22.2 | SUSE-SU-2025:3809-1 |
| openSUSE Leap 15.6 | rabbitmq-server313 | 3.13.1-150600.13.11.1 | SUSE-SU-2025:03234-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | rabbitmq-server | 3.13.7-3 | — |
Advisories 5
- openSUSE-SU-2025:15410-1 erlang-rabbitmq-client-3.13.7-5.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:3809-1 Security update for rabbitmq-server SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03234-1 Security update for rabbitmq-server313 SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-1363 RabbitMQ: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Oct 27, 2025
- USN-7763-1 rabbitmq-server vulnerability Ubuntu Security Notices (USN) · Oct 13, 2025