CVE-2026-21852

Published Jan 21, 2026

Last updated 4 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-21852 is an information disclosure vulnerability identified in Claude Code, an agentic coding tool. This flaw allows malicious repositories to exfiltrate sensitive data, including Anthropic API keys, before users have confirmed their trust in the repository. The vulnerability arises because an attacker-controlled repository can include a settings file that sets the `ANTHROPIC_BASE_URL` to an endpoint controlled by the attacker. When such a repository is opened, Claude Code reads this configuration and immediately issues API requests, potentially leaking the user's API keys to the attacker's server before any trust prompt is displayed. This vulnerability is characterized as a configuration injection flaw (CWE-522: Insufficiently Protected Credentials) within Claude Code's initialization sequence. The core issue lies in the timing of configuration file parsing relative to user trust verification, allowing API requests with authentication credentials to be sent to an attacker-specified endpoint before user consent. This enables attackers to steal Anthropic API keys by convincing developers to clone and open malicious repositories. Versions of Claude Code prior to 2.0.65 are affected.

Description: Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the user's API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch, or to the latest version.
Source: security-advisories@github.com
NVD status: Analyzed
Products: claude_code

Risk scores

CVSS 4.0

Type: Secondary
Base score: 5.3
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: MEDIUM

CVSS 3.1

Type: Primary
Base score: 7.5
Impact score: 3.6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-522

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:anthropic:claude_code:*:*:*:*:*:node.js:*:*",
            "matchCriteriaId": "DD35DBC7-825A-49D0-825E-8DD6BE1A257A",
            "versionEndExcluding": "2.0.65",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.