diff --git a/src/content/changelog/waf/2026-08-20-leaked-credentials-authorization-header.mdx b/src/content/changelog/waf/2026-08-20-leaked-credentials-authorization-header.mdx
new file mode 100644
index 00000000000..a76c180fa1c
--- /dev/null
+++ b/src/content/changelog/waf/2026-08-20-leaked-credentials-authorization-header.mdx
@@ -0,0 +1,13 @@
+---
+title: "Leaked credentials detection now scans Authorization headers"
+description: Leaked credentials detection can now detect Basic Authentication credentials sent in the Authorization header.
+date: 2026-08-20
+---
+
+[Leaked credentials detection](/waf/detections/leaked-credentials/) now scans the `Authorization` request header for Basic Authentication credentials. Previously, the detection only inspected request bodies, query strings, and headers for well-known web applications or custom detection locations, which meant credentials sent through HTTP Basic Authentication were not covered by default.
+
+This new default scan location decodes the `Authorization: Basic <credentials>` header and compares the extracted username and password against Cloudflare's database of leaked credentials, the same way as other default scan locations. Matches populate the existing [leaked credentials fields](/waf/detections/leaked-credentials/#leaked-credentials-fields), such as `cf.waf.credential_check.password_leaked`, and trigger the [`Exposed-Credential-Check` managed transform header](/rules/transform/managed-transforms/reference/#add-leaked-credentials-checks-header) if configured, so you can reuse existing [custom rules](/waf/custom-rules/) and [rate limiting rules](/waf/rate-limiting-rules/) without changes.
+
+This change was applied automatically for zones with leaked credentials detection enabled. No configuration changes are required.
+
+For more information, refer to [Leaked credentials detection](/waf/detections/leaked-credentials/).