RabbitMQ comes with a built-in username and password that you should replace when ready

RabbitMQ, an open-source message broker software, ships with a default user account: username guest and password guest. This account exists so you can test the system right after installation. The problem is that this same credential pair is identical on every RabbitMQ installation worldwide, which means anyone who knows RabbitMQ exists also knows how to log in to yours if you leave it unchanged.

The default guest account can only connect from localhost (the same machine running RabbitMQ) in RabbitMQ version 3.3.0 and later. This restriction provides some protection in production environments where RabbitMQ runs on a dedicated server. However, if your RabbitMQ instance is accessible over a network—or if you're running it in a container, virtual machine, or cloud environment where "localhost" is less meaningful—the default credentials become a real security gap.

Key Takeaways

  • RabbitMQ's default username is guest and the default password is guest, intended only for initial testing after installation.
  • The guest account is restricted to localhost connections in RabbitMQ 3.3.0 and later, but this protection does not explore if your server is accessible over a network.
  • You should create a new administrative user with a strong password and delete or disable the guest account before moving RabbitMQ to production.
  • Changing credentials involves using the rabbitmqctl command-line tool or the RabbitMQ management interface, both of which require access to the machine running RabbitMQ.

How to create a new user and remove the default account

To replace the default credentials, you need command-line access to the server where RabbitMQ is running. Use the rabbitmqctl tool, which comes with every RabbitMQ installation. The steps are: first, create a new user with a strong password; second, grant that user administrative permissions; third, delete the guest account.

The command to add a new user looks like this: rabbitmqctl add_user myusername mypassword. Replace myusername and mypassword with your chosen credentials. Next, give that user administrator rights by running rabbitmqctl set_user_tags myusername administrator. Finally, remove the guest account with rabbitmqctl delete_user guest. After these steps, the default credentials no longer work.

If you prefer a graphical interface, you can use the RabbitMQ Management Plugin, which runs on port 15672 by default. Log in with guest/guest, navigate to the Admin tab, and create a new user there. The management interface lets you set permissions and delete users without touching the command line, though you still need initial access to the machine or network where RabbitMQ runs.

Why the default password exists and what it protects against

The guest account serves a single purpose: letting you verify that RabbitMQ installed correctly and is responding to connections. Without a built-in user, a fresh installation would be unusable until you created credentials, which would complicate setup for developers testing locally. The tradeoff is that this convenience becomes a liability if the default account persists into production.

Leaving guest/guest in place exposes you to unauthorized message queue access. An attacker who can reach your RabbitMQ port (5672 for the message protocol, or 15672 for the web interface) can read messages, publish messages, create queues, and potentially disrupt your entire messaging system. In a microservices architecture where RabbitMQ coordinates work between services, this means an attacker could inject false tasks, steal data in transit, or halt processing.

When the localhost restriction actually protects you

RabbitMQ version 3.3.0 introduced a rule: the guest account can only log in from localhost, meaning the connection must originate from the same machine. This is a meaningful safeguard if your RabbitMQ server is truly isolated—a dedicated Linux box with no network exposure except to your own process servers on a private network.

The restriction breaks down in several common scenarios. If RabbitMQ runs in a Docker container, "localhost" refers to inside the container, not your host machine, so other containers on the same network can still use guest/guest. If you expose the RabbitMQ port to a cloud provider's internal network, or if you're running RabbitMQ in Kubernetes, the localhost check becomes ineffective. Even on a single machine, if you have multiple users or applications running, any of them can connect as guest from localhost.

Permissions and user roles in RabbitMQ

RabbitMQ distinguishes between users and permissions. A user is an account with a username and password; permissions control what that user can do. The guest account comes with full permissions by default, meaning it can create exchanges, declare queues, publish messages, and consume messages across the entire RabbitMQ instance.

When you create a new administrative user, you're giving it the administrator tag, which grants full access. For production systems, consider creating separate users with limited permissions: one user for each process that connects to RabbitMQ, each with access only to the exchanges and queues it actually needs. This way, if one process's credentials are compromised, the attacker cannot access resources belonging to other applications.

Changing credentials in a running system

If RabbitMQ is already in production and you need to change the default password without stopping the service, you can do so using rabbitmqctl. The command rabbitmqctl change_password guest newpassword updates the guest account's password without interrupting message flow. However, this approach leaves the guest account active, which is not ideal for security.

A safer approach is to create your new administrative user first, verify it works, then delete guest. This way, if something goes wrong during the transition, you still have a working account. If you cannot afford any downtime, create the new user, test it thoroughly in a staging environment that mirrors production, then schedule a brief maintenance window to remove guest and verify all your applications still connect properly.

Storing and managing new credentials securely

Once you create a new username and password, you need a way to store them that your applications can access without hardcoding them into source code. Common approaches include environment variables, configuration files with restricted file permissions, or a secrets management system like HashiCorp Vault or AWS Secrets Manager.

If you're using Docker or Kubernetes, pass credentials as environment variables or mount them from a secrets store. If you're running RabbitMQ on a traditional server, store the credentials in a configuration file that only the process user can read (permissions 600 or 640). Never commit credentials to version control, even in a private repository—treat them as you would a database password.

Frequently Asked Questions

Can I use the guest account if RabbitMQ is only on my local machine?

If RabbitMQ is truly isolated to your development machine and never exposed to a network, the guest account poses minimal risk during development. However, it's good practice to replace it even locally, so you don't accidentally deploy with default credentials. Creating a new user takes two minutes and builds the habit.

What happens if I forget the password for my new administrative user?

You can reset it using rabbitmqctl if you have command-line access to the RabbitMQ server. Run rabbitmqctl change_password username newpassword to set a new password. If you lose access to the server itself, you'll need to stop RabbitMQ, access its data directory, and rebuild the user database—a more involved process.

Do I need to restart RabbitMQ after changing users?

No. User and permission changes take effect when ready without restarting RabbitMQ or interrupting message flow. Existing connections remain open, but new connections must use the updated credentials.

Can I disable the guest account without deleting it?

RabbitMQ doesn't have a built-in "disable" feature for users. Your options are to delete the account entirely with rabbitmqctl delete_user guest, or to change its password to something you don't know and never use it. Deletion is cleaner and removes the account from the system entirely.

What if my process is already using guest/guest in production?

Update your process's connection string to use the new credentials, test it in a staging environment, then deploy the updated process. Create the new user in RabbitMQ before deploying the process change, so the new credentials are ready when the process tries to connect. This order prevents a window where the process cannot reach RabbitMQ.