CVE-2025-50200: 
RabbitMQ vulnerability analysis and mitigation

CVE-2025-50200 is an information disclosure vulnerability in RabbitMQ where the broker logs HTTP Basic Authentication headers in plaintext (base64-encoded) when errors occur during API requests. Affected versions include RabbitMQ 3.13.7 and prior; the issue was patched in versions 3.13.8, 4.0.8, and 4.1.0. The vulnerability was published on June 19, 2025, with the GitHub Security Advisory (GHSA-gh3x-4x42-fvq8) published by maintainer michaelklishin on June 18, 2025. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.7 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File). When a client queries the RabbitMQ HTTP API using Basic Authentication and an error condition is triggered (e.g., a request to a non-existent queue), RabbitMQ logs the full set of HTTP request headers — including the Authorization header containing the base64-encoded username:password string — to its error log. Since base64 is trivially reversible, any party with read access to the RabbitMQ log files can recover plaintext credentials. The vulnerability was confirmed on Windows with RabbitMQ 3.13.7 and 3.13.2 running Erlang 26.2.5, and a proof-of-concept PowerShell script was included in the advisory (GitHub Advisory).

Successful exploitation results in the disclosure of RabbitMQ user credentials to any local attacker with read access to the log files, compromising confidentiality with no impact on integrity or availability. Depending on the privilege level of the exposed credentials, an attacker could gain administrative control over the RabbitMQ instance, access message queues containing sensitive application data, or use the credentials for lateral movement within the environment. The risk is amplified in shared or multi-tenant environments where log files may be accessible to multiple users or processes (GitHub Advisory, Red Hat Bugzilla).

A proof-of-concept exploit (a PowerShell script) is publicly available in the GitHub Security Advisory, demonstrating how to trigger the credential logging by sending an authenticated API request to a non-existent queue. Exploitation requires local access to the RabbitMQ log files, meaning the attacker must already have low-privilege local access to the host. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.016% (0.000160), reflecting low probability of near-term exploitation (GitHub Advisory).

1. Reconnaissance: Identify a RabbitMQ instance running version 3.13.7 or earlier with the HTTP management API enabled (default port 15672). Confirm local or log-file access on the host.
2. Trigger an error condition: Using any valid RabbitMQ user account, send an authenticated HTTP API request that will produce an error — for example, a POST request to a non-existent queue endpoint such as http://localhost:15672/api/queues/%2F/NONEXISTENT_QUEUE/get with a Basic Auth header.
3. Example PoC (PowerShell):

$Username = "tmp"
$Password = "tmp"
$EncodedCredentials = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes("$Username`:$Password"))
$Headers = @{ "Authorization" = "Basic $EncodedCredentials"; "Content-Type" = "application/json" }
$Body = @{ "count" = 10; "requeue" = $false; "encoding" = "auto" } | ConvertTo-Json -Compress
Invoke-WebRequest -Uri "http://localhost:15672/api/queues/%2F/RANDOM/get" -Method Post -Headers $Headers -Body $Body

4. Access log files: Read the RabbitMQ error log (e.g., rabbit@<hostname>.log) and search for log entries containing authorization headers in the format <<"authorization">> => <<"Basic <base64string>">> .
5. Decode credentials: Decode the base64 string using any standard tool (e.g., echo '<base64>' | base64 -d) to recover the plaintext username:password.
6. Leverage credentials: Use the recovered credentials to authenticate to the RabbitMQ management console or API, potentially gaining administrative control depending on the privilege level of the exposed account (GitHub Advisory).

• Logs: RabbitMQ error log entries (e.g., rabbit@<hostname>.log) containing headers => #{<<"authorization">> => <<"Basic ...">>} — indicating that HTTP Basic Auth headers were captured in error output.
• Logs: Repeated API error log entries for requests to non-existent or invalid queues, particularly from unexpected source users or IP addresses, which may indicate deliberate triggering of the logging behavior.
• File System: Unexpected access or reads of RabbitMQ log files by non-administrative local users or processes, detectable via file access auditing (e.g., Windows Security Event Log, Linux auditd).
• Network: Unusual or repeated HTTP POST/GET requests to the RabbitMQ management API (port 15672) targeting non-existent resources, potentially indicating an attacker probing to generate error logs (GitHub Advisory).

Upgrade RabbitMQ to a patched version: 3.13.8, 4.0.8, or 4.1.0 or later. As interim mitigations, restrict read access to RabbitMQ log files to only the service account and administrators, and rotate any credentials that may have been exposed in logs. Additionally, review existing log files for captured authorization headers and consider implementing log scrubbing or redaction controls. Using strong, unique credentials for RabbitMQ accounts limits the blast radius if credentials are exposed (GitHub Advisory, Red Hat Bugzilla).

The vulnerability was reported by a researcher identified as "HyperReap" and acknowledged by RabbitMQ maintainer michaelklishin via the GitHub Security Advisory program. Red Hat tracked the issue via Bugzilla (Bug 2373901) and assigned it medium severity. Downstream Linux distributions including Ubuntu and SUSE issued security updates for their packaged versions of rabbitmq-server, and Debian included the fix in a stable release update. Coverage appeared in security news aggregators and Linux security advisories shortly after disclosure (GitHub Advisory, Red Hat Bugzilla).