Skip to main content
protocols.pageprotocols.page
15672

Port 15672 – RabbitMQ Management UI

TCP

Port 15672 is the RabbitMQ Management Plugin web UI and HTTP API. It provides queue management, exchange inspection, message publishing, and cluster monitoring. Port 15672 should never be exposed to the public internet without authentication and ideally should be proxied behind nginx with TLS. The AMQP broker runs on port 5672.

Port Number

15672

Protocol

TCP

Service

RabbitMQ Management Console

Range

IANA Registered (1024–49151)

Description

The RabbitMQ Management Plugin exposes an HTTP API on port 15672 alongside a web UI. The default credentials are guest/guest (only accessible from localhost by default). Port 15672 enables: listing queues/exchanges/bindings, publishing test messages, monitoring connection counts, and triggering policies. In production, access should be restricted by IP and served over HTTPS via a reverse proxy.

Security risks

  • 1CVE-2021-32719: RabbitMQ Management UI XSS via federation upstream names – stored XSS executed when admin views federation status (fixed 3.8.18)
  • 2CVE-2021-32718: RabbitMQ Management plugin CSRF – attacker tricks admin into visiting page that creates exchanges/queues/bindings (fixed 3.8.18)
  • 3Default credentials: guest/guest works on localhost by default (since 3.3.0 restricted to loopback, but Docker containers expose it on 0.0.0.0)
  • 4Management API provides full administrative access: create/delete queues, purge messages, download message payloads, export/import definitions (full cluster config backup)
  • 5Health check endpoints (/api/health/checks/alarms) require no auth in some configurations – leak cluster alarm state to unauthenticated clients

Firewall guidance

Port 15672 should be accessible only from admin workstations and monitoring systems. Never expose to the internet – even with changed credentials, the attack surface is large (XSS, CSRF, API access). Deploy behind VPN or bastion host. In Kubernetes, use port-forward for admin access rather than Ingress. If external access needed, use oauth2-proxy + TLS.

Diagnosis commands

Quick cluster health – total queued messages and active consumers

shell
curl -u admin:password http://localhost:15672/api/overview | jq '{messages: .queue_totals.messages, consumers: .object_totals.consumers}'

Find queues with message backlog (>1000)

shell
curl -u admin:password http://localhost:15672/api/queues | jq '.[] | select(.messages > 1000) | {name, messages, consumers}'

Count connections by user (detect unauthorized access)

shell
curl -u admin:password http://localhost:15672/api/connections | jq '.[].user' | sort | uniq -c | sort -rn

Verify all RabbitMQ ports are accessible between cluster nodes

shell
rabbitmq-diagnostics check_port_connectivity

Usage examples

Port 15672 – RabbitMQ Management UI
shell
curl -u guest:guest http://localhost:15672/api/overview
curl -u guest:guest http://localhost:15672/api/queues

Common services on this port

RabbitMQ Management PluginRabbitMQ Shovel UIRabbitMQ Federation UI

Related ports

5672

AMQP (RabbitMQ messaging)

5671

AMQPS (AMQP over TLS)

4369

EPMD (Erlang node discovery)

15692

Prometheus metrics (rabbitmq_prometheus plugin)

25672

Erlang distribution (inter-node)

History

The RabbitMQ Management Plugin was introduced around 2010, providing a web UI and REST API for queue management. Port 15672 was chosen as 15000 + 672 (the AMQP port). Before the management plugin, rabbitmqctl was the only admin interface. The plugin became essential for monitoring queue depths, connection counts, and message rates. RabbitMQ 3.8+ added per-vhost and per-user API rate limiting.

FAQ

How do I change the default guest/guest credentials?

Delete the guest user and create a new admin: rabbitmqctl delete_user guest && rabbitmqctl add_user admin StrongPassword123 && rabbitmqctl set_user_tags admin administrator && rabbitmqctl set_permissions -p / admin '.*' '.*' '.*'. Since RabbitMQ 3.3.0, guest can only connect from localhost by default, but Docker images often set RABBITMQ_DEFAULT_USER/PASS environment variables.

Can I run RabbitMQ Management on a different port?

Yes. In rabbitmq.conf: management.tcp.port = 15673 (or any port). In advanced.config (Erlang format): [{rabbitmq_management, [{tcp_config, [{port, 15673}]}]}]. You can also bind to localhost only: management.tcp.ip = 127.0.0.1. For HTTPS: management.ssl.port = 15671 with management.ssl.certfile and management.ssl.keyfile.