CVE-2026-21852

Deeper analysis

CVE-2026-21852 is a vulnerability in Claude Code, an agentic coding tool developed by Anthropic, affecting versions prior to 2.0.65. The issue resides in the project's load flow, where malicious repositories can exfiltrate sensitive data, including users' Anthropic API keys, before a trust confirmation prompt is displayed. Specifically, an attacker-controlled repository can include a settings file that overrides the ANTHROPIC_BASE_URL environment variable to point to an attacker-controlled endpoint. Upon opening the repository, Claude Code reads this configuration and issues API requests immediately, bypassing user approval. The vulnerability is rated with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and is associated with CWE-522 (Insufficiently Protected Credentials).

Attackers can exploit this vulnerability remotely with no privileges or user interaction beyond convincing a target to open a malicious repository, such as via social engineering through shared links or recommendations. No authentication is required, making it accessible to any remote adversary. Successful exploitation allows the attacker to capture API requests containing the victim's Anthropic API keys, enabling unauthorized access to the victim's Anthropic services, potential further compromise of associated accounts, and exfiltration of additional data processed through those APIs.

The security advisory at https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7 recommends updating to version 2.0.65 or later, which includes a patch addressing the configuration override issue. Users on the standard auto-update channel have already received the fix, while those using manual updates must apply it explicitly to mitigate the risk.