CVE-2026-21852mediumCWE-522

CVE-2026-21852: medium-severity vulnerability in anthropics claude-code

Claude Code Leaks Data via Malicious Environment Configuration Before Trust Confirmation

Published

Follow this CVE+ Monitor claude-code+ Monitor @anthropic-ai/claude-code

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

18Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 28%
In short

Claude Code loaded malicious project settings before asking users for permission, allowing attackers to steal API keys by redirecting requests to fake servers. This happened automatically when opening a repository, before any trust confirmation.

Technical detail

CWE-522 (Insufficient Logging) manifests as premature API credential exposure: malicious repository configuration files could redirect ANTHROPIC_BASE_URL to attacker-controlled endpoints, causing Claude Code to leak API keys in requests before displaying the trust prompt. The attack requires the victim to open an attacker-controlled repository, but exploitation occurs automatically during project initialization without user interaction.

Summary generated and translated by AI from the official description.
Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the user's API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch, or to the latest version.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Affected products
anthropics · claude-code
Related CVEs — anthropics claude-code

In the same product, most dangerous first.

CVE-2025-59536HIGHClaude Code's startup trust dialog could lead to Command Execution attackEPSS 24.9%CVE-2025-54794HIGHClaude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file accessEPSS 1.5%CVE-2025-54795HIGHClaude Code echo command allowed bypass of user approval prompt for command executionEPSS 1.1%CVE-2025-66032HIGHClaude Code Command Validation Bypass Allows Arbitrary Code ExecutionEPSS 0.7%CVE-2026-39861HIGHClaude Code: Sandbox Escape via Symlink Following Allows Arbitrary File Write Outside WorkspaceEPSS 0.7%CVE-2026-55607HIGHClaude Code: Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code ExecutionEPSS 0.7%