---
id: CVE-2022-31008
title: >-
  RabbitMQ has predictable credential obfuscation seed value used in Shovel and
  Federation plugins
summary: >-
  RabbitMQ has predictable credential obfuscation seed value used in Shovel and
  Federation plugins
severity: medium
cvss: 5.5
cwe:
  - CWE-330
  - CWE-335
vendor: rabbit_common
product: rabbit_common
ecosystem: erlang
affected:
  - 'rabbit_common >= 3.10.0, < 3.10.2'
  - 'rabbit_common >= 3.9.0, < 3.9.18'
  - 'rabbit_common >= 3.8.0, < 3.8.32'
patched:
  - rabbit_common 3.10.2
  - rabbit_common 3.9.18
  - rabbit_common 3.8.32
published: '2026-06-30'
updated: '2026-06-30'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-v9gv-xp36-jgj8'
references:
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-31008'
  - url: 'https://github.com/rabbitmq/rabbitmq-server/pull/4841'
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/commit/c22e1cb20e656d211e025c417d1fc75a9067b717
  - url: 'https://github.com/advisories/GHSA-v9gv-xp36-jgj8'
tags:
  - ghsa
  - erlang
epss: 0.00343
epssPercentile: 0.25075
ingestedAt: '2026-06-30T17:40:12.494Z'
---

## Overview

### Impact

Shovel and Federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt
the URI was seeded with a predictable secret.

This means that in case of certain exceptions related to Shovel and Federation plugins,
reasonably easily deobfuscatable data could appear in the node log.

Patched versions correctly use a cluster-wide secret for that purpose.

### Patches

Patched versions:

 * `3.10.2`
 * `3.9.18`
 * `3.8.32`

### Workarounds

Disable Shovel and Federation plugins.

### Credits

RabbitMQ core team would like to thank Lajos @luos Gerecs and Anh Nguyen from Erlang Solutions
for responsibly disclosing and working with us on a patch for this vulnerability.

### For more information

 * [Mailing list](https://groups.google.com/forum/#!forum/rabbitmq-users)
 * [Community Slack](https://rabbitmq-slack.herokuapp.com/)

## Affected packages

- `rabbit_common >= 3.10.0, < 3.10.2`
- `rabbit_common >= 3.9.0, < 3.9.18`
- `rabbit_common >= 3.8.0, < 3.8.32`

## Remediation

Upgrade to a patched release:

- `rabbit_common 3.10.2`
- `rabbit_common 3.9.18`
- `rabbit_common 3.8.32`