CVE-2022-31008High· 7.5▾ TwilightA flaw was found in RabbitMQ. The shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. In certain exceptions related to Shovel …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.3%
Last analysed / modified upstream
5.5 → 7.5
medium → high
0.3% → 0.4%
A flaw was found in RabbitMQ. The shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. In certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log.
rabbitmq-server: URI encryption with predictable secret seed — rated Moderate by Red Hat. Released 2022-10-05, updated 2026-10-20.
Not affected:
Refer to the advisory for fix availability.
Affected packages:
rabbit_common >= 3.10.0, < 3.10.2rabbit_common >= 3.9.0, < 3.9.18rabbit_common >= 3.8.0, < 3.8.32Patched in:
rabbit_common 3.10.2rabbit_common 3.9.18rabbit_common 3.8.32Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55889Medium· 5.3xdg-desktop-portal: xdg-desktop-portal: unauthorized data disclosure via predictable token generation (CVE-2026-55889)
CVE-2026-106074Medium· 4.8nodejs: nodejs: predictable random values via snapshot entropy cache reuse (CVE-2026-106074)
CVE-2026-45673Medium· 6.8netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs (CVE-2026-45673)
CVE-2024-52615Medium· 5.3A flaw was found in Avahi-daemon, which relies on fixed source ports for wide-area DNS queries
CVE-2026-98870Medium· 6.5kernel: ksmbd: remove stale channels from all sessions on teardown (CVE-2026-98870)
CVE-2026-114127Medium· 5.4astro: Astro: CSS injection via unvalidated view transition animation properties (CVE-2026-114127)