CVE-2026-67406

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 4.0.0 through 4.0.22 RabbitMQ versions 4.1.0 through 4.1.13 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2

Description The Shovel component fails to format state logged by the crash reporter, which can lead to unencrypted credentials being left in crash dump files. The shovel worker genserver processes do not implement the formatstatus/2 callback. Consequently, when these processes crash due to events such as network partitions or connection failures, the OTP SASL error handler writes the full process state to the error log. This state includes deobfuscated plaintext AMQP passwords and URIs in the amqp://user:password@host format. These SASL error reports are active by default and do not require specific debug configurations to trigger.

Recommendations Update to version 4.0.23 Update to version 4.1.14 Update to version 4.2.9 Update to version 4.3.3