UpHeron
All vulnerabilities

Servers and applications

CVE-2025-50200

Node can log Basic Auth header from an HTTP request

Severity
Medium 6.7
Published
18 Jun 2025
Last changed
30 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.13.8, 4.0.8
Also known as
GHSA-gh3x-4x42-fvq8
Sources
NVD, Project advisories (GitHub)

Description

RabbitMQ is a messaging and streaming broker. In versions 3.13.7 and prior, RabbitMQ is logging authorization headers in plaintext encoded in base64. When querying RabbitMQ api with HTTP/s with basic authentication it creates logs with all headers in request, including authorization headers which show base64 encoded username:password. This is easy to decode and afterwards could be used to obtain…

Affected software

SoftwareAffected versions
RabbitMQServers and applications · cpe:a:broadcom:rabbitmq_server
  • Every version before 4.0.8
RabbitMQServers and applications · github:rabbitmq/rabbitmq-server
  • From 3.13.0 before 3.13.8
  • From 4.0.0 before 4.0.8

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-50200
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-50200
  • GitHub Advisory Database https://github.com/advisories/GHSA-gh3x-4x42-fvq8
  • github.com https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-gh3x-4x42-fvq8