RabbitMQ Shovel CVE-2026-67406

Requires the Shovel plugin to be configured and running with at least one shovel that holds upstream/downstream AMQP URIs containing embedded credentials. A shovel worker process must then crash (e.g., due to a network partition or connection failure) so the OTP SASL error handler serializes its state. No special logging configuration is needed - SASL error reports are always active, unlike DEBUG logging. Exploitation then requires read access to the node's error log or crash dump file (local filesystem access, an operator/admin account, or access to a log-shipping/aggregation system that ingested the dump). Limiting factors: credentials are only exposed after a crash event, the plugin must be in use, and no impact occurs to the node's own data (only the separate brokers whose credentials are leaked).

This is a genuine but low-urgency information-disclosure issue, not a high-priority remotely-exploitable flaw. The NVD CVSS 4.0 base is 4.6 (Medium) with vector AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H - note the confidentiality impact is entirely in the SUBSEQUENT system (SC:H), reflecting that the leaked data is credentials for OTHER (upstream/downstream) brokers, while the RabbitMQ node's own confidentiality is unaffected (VC:N). AT:P signals the required precondition: a Shovel worker must crash before any credential is written. There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided intelligence, so this is no public exploit identified at time of analysis - exploitation is opportunistic (reading logs after an incident) rather than an active attack technique. I disagree with the NVD AV:N choice: the actual exposure is passive plaintext credentials sitting in a node's SASL error log / crash dump, and harvesting them requires read access to those log files, which is a LOCAL, privileged operation - hence my assessment uses AV:L/PR:H. This is a real defect worth patching for anyone running Shovel (credential rotation may be needed if crash logs were shipped to a shared log aggregator), but the raw CVSS and the lack of EPSS/KEV/POC all point to LOW real-world priority relative to the atom-exhaustion DoS issues in the same product family.

A Shovel worker crashes during a routine network partition or connection failure (a common event), and the OTP SASL error handler writes the worker's full genserver state - including deobfuscated amqp://user:password@host upstream and downstream URIs - into the node's error log and crash dump. An operator with read access to those logs, or anyone able to reach a centralized/shared log aggregator that ingested them, then harvests the plaintext broker credentials. No public exploit code is required or identified; the exposure occurs automatically without any special configuration.