A newly disclosed vulnerability in Squid proxy software, nicknamed "Squidbleed," can expose usernames, passwords, and session tokens belonging to other users sharing the same proxy server. The flaw has existed undetected since 1997 and affects all default Squid installations.

• What it is: CVE-2026-47729, a memory leak in Squid's FTP parsing code. When exploited, Squid reads beyond a memory buffer and returns the contents of another user's HTTP request — including login credentials, authorisation headers, and API keys — to the attacker.
• Who is affected: Businesses, schools, and organisations running Squid proxy servers. Risk is highest in shared proxy environments where multiple users route traffic through the same server — common in corporate offices, educational institutions, and public Wi-Fi setups.
• What the risk is: An attacker already permitted to use the same proxy can silently extract cleartext HTTP credentials from other users. Normal HTTPS traffic is not exposed; only cleartext HTTP traffic and environments where Squid is configured to decrypt SSL are at risk.
• What action to take: Update Squid to version 7.7 or later, and confirm the fix is present in FtpGateway.cc. If FTP is not required on your network, disable it entirely — this removes the attack surface regardless of version. No active exploitation has been reported as of publication. Sources: The Hacker News, Calif.io.

We recommend contacting your IT team to confirm whether Squid proxy is in use on your network, and to verify that the patch has been applied or that FTP is disabled.