Vulnerability · Published Jun 19, 2025 · Assigned by GitHub_M
CVE-2025-50200RabbitMQ Node can log Basic Auth header from an HTTP request
Medium 6.7
In plain English
A medium-severity sensitive data in logs in rabbitmq-server from rabbitmq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:13 | rabbitmq-server | 4.0.5-6+deb13u2 | DEBIAN-CVE-2025-50200 |
| Debian:14 | rabbitmq-server | 4.0.5-9 | DEBIAN-CVE-2025-50200 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| rabbitmq | rabbitmq-server | <= 3.13.7 |
Weakness: CWE-532 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N