CVE-2025-50200

Publication date 19 June 2025

Last updated 24 September 2025

Ubuntu priority

Description

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
rabbitmq-server	25.04 plucky	Fixed 4.0.5-2ubuntu2.1
	24.10 oracular	Ignored end of life, was needs-triage
	24.04 LTS noble	Not affected
	22.04 LTS jammy	Not affected
	20.04 LTS focal	Not affected
	18.04 LTS bionic	Not affected
	16.04 LTS xenial	Not affected

Notes

mdeslaur

introduced by: https://github.com/rabbitmq/rabbitmq-server/commit/383ddb16341200f63091e2dd8bb7c0c6346e3ef7 (4.1.0) https://github.com/rabbitmq/rabbitmq-server/commit/a4465d7a728a41dba125c6c0553f124b45dbb6bd (3.13.2)

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
rabbitmq-server	Upstream: 0a7c86b Upstream: https://github.com/rabbitmq/rabbitmq-server/pull/13612

References

Related Ubuntu Security Notices (USN)

USN-7763-1
RabbitMQ Server vulnerability
23 September 2025