CVE-2025-50200 RabbitMQ Node can log Basic Auth header from an HTTP request
RabbitMQ logs Basic Auth headers in plaintext, allowing attackers with log access to decode credentials and potentially take over the system.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-50200?
CVE-2025-50200 is a medium-severity vulnerability in Broadcom Rabbitmq Server, published on 19 Jun 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain control to the system depending on credentials. This issue has been patched in version 4.0.8.
Weakness: CWE-532
Which versions are affected by CVE-2025-50200?
1 open source package ship an affected version, including rabbitmq. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
rabbitmq Bitnami | All versions | 4.0.8 |
Linux distribution packages (7)
rabbitmq-server SUSE:Linux Enterprise Module for Server Applications 15 SP6 | All versions | 3.8.11-150300.3.22.2 |
rabbitmq-server313 SUSE:Linux Enterprise Module for Server Applications 15 SP6 | All versions | 3.13.1-150600.13.11.1 |
rabbitmq-server SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 3.8.11-150300.3.22.2 |
rabbitmq-server313 SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 3.13.1-150600.13.11.1 |
rabbitmq-server openSUSE:Leap 15.6 | All versions | 3.8.11-150300.3.22.2 |
rabbitmq-server313 openSUSE:Leap 15.6 | All versions | 3.13.1-150600.13.11.1 |
rabbitmq-server openSUSE:Tumbleweed | All versions | 3.13.7-5.1 |
Products include Broadcom Rabbitmq Server.
How do I fix CVE-2025-50200?
Upgrade rabbitmq to 4.0.8 or later.
Is CVE-2025-50200 being exploited?
There is no known exploitation of CVE-2025-50200 in the wild and no public exploit code.
Other vulnerabilities in Broadcom Rabbitmq Server
- CVE-2016-9877 Auth bypass in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12 and 1.7.x before 1.7.7
- CVE-2026-67404 RabbitMQ: OAuth2 silent verify_none fallback for JWKS fetch
- CVE-2026-67231 RabbitMQ: Trust-store whitelist by Issuer+Serial only
- CVE-2026-57219 Information disclosure in rabbitmq-server
- CVE-2026-67236 RabbitMQ: Plaintext username:password stored in an insecure cookie after successful POST /login
Sources
Also known as AZL-64166, BIT-rabbitmq-2025-50200, DEBIAN-CVE-2025-50200, GHSA-gh3x-4x42-fvq8, MINI-37g4-jj96-8j77, MINI-r32f-c2cp-5q5w and 5 more.