Read the docs
TI-2022-13054 Aliases CVE-2022-31008GHSA-v9gv-xp36-jgj8

Predictable credential obfuscation seed value used in rabbitmq-server

Priority LOW 33CWE-330Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.

Summary

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Fixed rabbitmq-server (rabbitmq): 3.8.32, 3.9.18, 3.10.2rabbit_common (Hex): 3.10.2, 3.9.18, 3.8.32

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
rabbitmqrabbitmq-serverbefore 3.8.32; 3.9.0 to before 3.9.18; 3.10.0 to before 3.10.23.8.32, 3.9.18, 3.10.2Patch availableCNA
—rabbit_common (Hex)3.10.0 to before 3.10.23.10.2Patch availableGHSA-v9gv-xp36-jgj8
—rabbit_common (Hex)3.9.0 to before 3.9.183.9.18Patch availableGHSA-v9gv-xp36-jgj8
—rabbit_common (Hex)3.8.0 to before 3.8.323.8.32Patch availableGHSA-v9gv-xp36-jgj8
  • rabbitmq-server Vendorrabbitmq Affected before 3.8.32; 3.9.0 to before 3.9.18; 3.10.0 to before 3.10.2 Fixed in 3.8.32, 3.9.18, 3.10.2 Patch available CNA
  • rabbit_common (Hex) Vendor— Affected 3.10.0 to before 3.10.2 Fixed in 3.10.2 Patch available GHSA-v9gv-xp36-jgj8
  • rabbit_common (Hex) Vendor— Affected 3.9.0 to before 3.9.18 Fixed in 3.9.18 Patch available GHSA-v9gv-xp36-jgj8
  • rabbit_common (Hex) Vendor— Affected 3.8.0 to before 3.8.32 Fixed in 3.8.32 Patch available GHSA-v9gv-xp36-jgj8

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:*3.9.0 to before 3.9.18; 3.10.0 to before 3.10.2VulnerableBroadcom
cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:*before 3.8.32VulnerableVMware
  • cpe:2.3:a:broadcom:rabbitmq_server:*:*:*:*:*:*:*:* Versions 3.9.0 to before 3.9.18; 3.10.0 to before 3.10.2 Vulnerable ·Broadcom
  • cpe:2.3:a:vmware:rabbitmq:*:*:*:*:*:*:*:* Versions before 3.8.32 Vulnerable ·VMware

Remediation

  • Fix · CNA rabbitmq-server (rabbitmq) Fixed in 3.8.32, 3.9.18, 3.10.2
  • Fix · GHSA-v9gv-xp36-jgj8 rabbit_common (Hex) Fixed in 3.10.2 Advisory →
  • Fix · GHSA-v9gv-xp36-jgj8 rabbit_common (Hex) Fixed in 3.9.18 Advisory →
  • Fix · GHSA-v9gv-xp36-jgj8 rabbit_common (Hex) Fixed in 3.8.32 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-31008
  2. 2026-10-03 Alias added: GHSA-v9gv-xp36-jgj8
  3. 2026-10-20 Affected versions changed · Red Hat

References

Patch 1

Advisory 2

Other 2

  • TI-2026-41154 Improper authentication in rabbitmq-server CVSS 3.1CRITICAL 10.0
  • TI-2026-41149 RabbitMQ: UNC SSRF affecting the management UI on Windows CVSS 3.1CRITICAL 10.0
  • TI-2026-41158 Resource allocation without limits in rabbitmq-server CVSS 3.1HIGH 7.5
  • TI-2026-47695 RabbitMQ: OAuth2 Client Secret Exposed via Unauthenticated JavaScript Endpoint CVSS 4.0HIGH 8.2
  • TI-2026-47694 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CVSS 4.0HIGH 8.2
  • TI-2026-45167 RabbitMQ Java client: Unvalidated Class.forName in JSON-RPC ProcedureDescription enables arbitrary class loading CVSS 4.0HIGH 7.5
See all 100 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences