CVE-2025-62168: Squid proxy leaks HTTP auth credentials in error messages

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5 with network-reachable, unauthenticated credential disclosure and very high EPSS, though no KEV listing or known exploitation is documented.

What it is

Squid versions prior to 7.2 fail to redact HTTP authentication credentials when generating error handling output, allowing information disclosure. A remote client can learn credentials a trusted client uses to authenticate, including internal security tokens used by web applications that rely on Squid for backend load balancing. The flaw is fixed in 7.2.

Impact

An attacker gains credentials and security tokens used by trusted clients or internal web applications, enabling impersonation or further access to backend services. Only confidentiality is affected; there is no integrity or availability impact per the CVSS vector.

Attack surface

Reachable remotely over the network with no authentication and no user interaction (CVSS AV:N/AC:L/PR:N/UI:N). The description notes the attack does not require Squid to be configured with HTTP authentication, so any exposed Squid instance may be a target.

Exploitation

Not listed in CISA KEV and no public exploit or ransomware usage is documented in the record. EPSS is high at 0.6336 (99.17th percentile), indicating elevated predicted exploitation likelihood, and a patch commit is referenced.

What to do

• Upgrade Squid to version 7.2 or later.
• If immediate upgrade is not possible, set email_err_data off in squid.conf to disable debug information in administrator mailto links.
• Restrict network access to Squid proxy interfaces to trusted clients only.
• Rotate any credentials or tokens that may have been exposed through Squid error output.
• Monitor vendor advisory GHSA-c8cc-phh7-xmxr for updated guidance.

Detection

• Inspect Squid error pages and administrator mailto links for unredacted Authorization or credential data.
• Search Squid logs and generated error responses for authentication headers or token strings.
• Monitor for anomalous requests that trigger Squid error handling from untrusted sources.
• Alert on outbound connections from Squid hosts to unexpected destinations that could indicate credential use.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.