CVE-2022-31008 - CVE House
Back to Database
Status published Medium CVE-2022-31008

Predictable credential obfuscation seed value used in rabbitmq-server

Vulnerability Description

RabbitMQ is a multi-protocol messaging and streaming broker. In affected versions the shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. This means that in case of certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log. Patched versions correctly use a cluster-wide secret for that purpose. This issue has been addressed and Patched versions: `3.10.2`, `3.9.18`, `3.8.32` are available. Users unable to upgrade should disable the Shovel and Federation plugins.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-31008

Credits & Attribution

No credits recorded in the NVD database.

References

More from rabbitmq

View All →
CVE-2025-50200
RabbitMQ Node can log Basic Auth header from an HTTP request
Medium 6.7
CVE-2025-30219
RabbitMQ has XSS Vulnerability in an Error Message in Management UI
Medium 6.1
CVE-2024-51988
HTTP API's queue deletion endpoint does not verify that the user has a required permission
Medium 6.5
CVE-2023-46120
RabbitMQ Java client's lack of message size limitation leads to remote DoS attack
Medium 4.9
CVE-2023-46118
Denial of Service by publishing large messages over the HTTP API
Medium 4.9

Affected Vendor

Affected Software

rabbitmq-server
Vulnerable Versions:
< 3.8.32, >= 3.9.0, < 3.9.18, >= 3.10.0, < 3.10.2

Timeline

Official Publish: October 6th, 2022
Last Modified: April 23rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-330

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.