Squidbleed Vulnerability - Authorization Header Extraction Attempt

Ankit Mehta@Secvyn

•updated Jun 24, 2026•0•0•1

This rule detects attempts to extract authorization headers (Bearer, Basic, or X-API-Key) over FTP (port 21) by inspecting network signatures. This could indicate an attempt to exploit a vulnerability or misconfiguration where sensitive credentials are being transmitted in an insecure manner.