GitHub Advisoryadvisory · Hex

GHSA-v9gv-xp36-jgj8 RabbitMQ has predictable credential obfuscation seed value used in Shovel and Federation plugins

MEDIUM Published 2026-06-30 Modified 2026-06-30 Official page ↗
Aliases
CVE-2022-31008
Ecosystem
Hex
Packages
rabbit_common
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-330, CWE-335
Reviewed
2026-06-30

Affected packages

• Hex rabbit_common: >= 3.10.0, < 3.10.2 → fixed in 3.10.2 • Hex rabbit_common: >= 3.9.0, < 3.9.18 → fixed in 3.9.18 • Hex rabbit_common: >= 3.8.0, < 3.8.32 → fixed in 3.8.32

Description

Impact Shovel and Federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. Patches Patched versions: • `3.10.2` • `3.9.18` • `3.8.32` Workarounds Disable Shovel and Federation plugins. Credits RabbitMQ core team would like to thank Lajos @luos Gerecs and Anh Nguyen from Erlang Solutions for responsibly disclosing and working with us on a patch for this vulnerability. For more information • Mailing list • Community Slack

Related

Alias · CVE (1)

  • CVE-2022-31008 RabbitMQ is a multi-protocol messaging and streaming broker. vulnerability

Weakness · CWE (2)

  • CWE-330 Use of Insufficiently Random Values weakness
  • CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) weakness

References