Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-24052 is a high-severity Open Redirect (CWE-601) vulnerability in Anthropic Claude Code. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Phishing (T1566); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
This vulnerability is AI-related — categorised as Enterprise AI Assistants; in the Privacy and Disclosure risk domain.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-24052 affects Claude Code, an agentic coding tool from Anthropic, in versions prior to 1.0.111. The vulnerability stems from insufficient URL validation in the trusted domain verification mechanism for WebFetch requests. Specifically, the application relied on a startsWith() function to check trusted domains such as docs.python.org and modelcontextprotocol.io, which allowed attacker-controlled domains like modelcontextprotocol.io.example.com to pass validation.
Remote attackers require no privileges but need user interaction to exploit this issue, as indicated by its CVSS score of 7.4 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N). By registering a domain that mimics a trusted one via prefix matching, an attacker could trick Claude Code into issuing automatic WebFetch requests to their controlled server without user consent, enabling potential data exfiltration from the user's environment.
The issue, classified under CWE-601 (URL Redirection to Untrusted Site), has been addressed in Claude Code version 1.0.111. Security practitioners should upgrade to this version or later. Additional details are available in the GitHub Security Advisory at https://github.com/anthropics/claude-code/security/advisories/GHSA-vhw5-3g5m-8ggf.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5172
Vulnerability Data
Claude Code is an agentic coding tool. Prior to version 1.0.111, Claude Code contained insufficient URL validation in its trusted domain verification mechanism for WebFetch requests. The application used a startsWith() function to validate trusted domains (e.g., docs.python.org, modelcontextprotocol.io), this…
more
could have enabled attackers to register domains like modelcontextprotocol.io.example.com that would pass validation. This could enable automatic requests to attacker-controlled domains without user consent, potentially leading to data exfiltration. This issue has been patched in version 1.0.111.
- CWE(s)
AI Security AnalysisAI
- AI Category
- Enterprise AI Assistants
- Risk Domain
- Privacy and Disclosure
- OWASP Top 10 for LLMs 2025
- None mapped
- Classification Reason
- Matched keywords: claude
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.7.2
Mitigating Controls (NIST 800-53 r5) AI
Input validation directly checks and rejects untrusted redirect targets before they are used in a response.
Information flow enforcement can restrict redirects to only approved/trusted destinations, stopping untrusted user-supplied URLs from being followed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require input validation and untrusted-redirect controls that prevent CWE-601.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Preventing access to attacker-controlled or malicious sites stops users from being redirected to untrusted locations via open-redirect or phishing links.