---
id: CVE-2022-31008
title: 'rabbitmq-server: URI encryption with predictable secret seed (CVE-2022-31008)'
summary: >-
  A flaw was found in RabbitMQ. The shovel and federation plugins perform URI
  obfuscation in their worker (link) state. The encryption key used to encrypt
  the URI was seeded with a predictable secret. In certain exceptions related to
  Shovel …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: vendor
cwe:
  - CWE-337
  - CWE-330
  - CWE-335
vendor: Red Hat
product: rabbit_common
affected:
  - 'rabbit_common >= 3.10.0, < 3.10.2'
  - 'rabbit_common >= 3.9.0, < 3.9.18'
  - 'rabbit_common >= 3.8.0, < 3.8.32'
patched:
  - rabbit_common 3.10.2
  - rabbit_common 3.9.18
  - rabbit_common 3.8.32
published: '2022-10-05'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T08:38:48+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-31008.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-31008.json
  - url: 'https://access.redhat.com/security/cve/CVE-2022-31008'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2141397'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2022-31008'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-31008'
  - url: 'https://github.com/rabbitmq/rabbitmq-server/pull/4841'
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-v9gv-xp36-jgj8
  - url: >-
      https://github.com/rabbitmq/rabbitmq-server/commit/c22e1cb20e656d211e025c417d1fc75a9067b717
  - url: 'https://github.com/advisories/GHSA-v9gv-xp36-jgj8'
tags:
  - csaf
  - vex
  - red-hat
  - ghsa
  - erlang
  - score-dispute
epss: 0.00397
epssPercentile: 0.33789
ecosystem: erlang
scores:
  vendor: 7.5
  ghsa: 5.5
ingestedAt: '2026-06-30T17:40:12.494Z'
---

## Overview

A flaw was found in RabbitMQ. The shovel and federation plugins perform URI obfuscation in their worker (link) state. The encryption key used to encrypt the URI was seeded with a predictable secret. In certain exceptions related to Shovel and Federation plugins, reasonably easily deobfuscatable data could appear in the node log.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-31008.json)

**rabbitmq-server: URI encryption with predictable secret seed** — rated Moderate by Red Hat. Released 2022-10-05, updated 2026-10-20.

Not affected:

- Red Hat OpenStack Platform 13 (Queens)
- Red Hat OpenStack Platform 16.1
- Red Hat OpenStack Platform 16.2
- Red Hat OpenStack Platform 17.0

## Remediation

Refer to the advisory for fix availability.

## Package advisory (CVE-2022-31008)

Affected packages:

- `rabbit_common >= 3.10.0, < 3.10.2`
- `rabbit_common >= 3.9.0, < 3.9.18`
- `rabbit_common >= 3.8.0, < 3.8.32`

Patched in:

- `rabbit_common 3.10.2`
- `rabbit_common 3.9.18`
- `rabbit_common 3.8.32`

Source: https://github.com/advisories/GHSA-v9gv-xp36-jgj8