Skip to content

Back to the catalog

sentinelone.comadvisory

CVE-2026-21852 — Claude Code Information Disclosure (pre-trust config injection leaks API keys)

CVE-2026-21852 describes a flaw in Claude Code versions prior to 2.0.65 where a malicious repository's settings file can override ANTHROPIC_BASE_URL and have it applied during project load before the user sees or accepts the trust-confirmation prompt, causing the user's Anthropic API key to be sent to an attacker-controlled endpoint. The root cause is an initialization-order bug (CWE-522, insufficiently protected credentials) where untrusted repo config is parsed and acted on ahead of trust verification; Anthropic fixed it in 2.0.65 by moving trust checks before config processing. Mitigations include updating, rotating exposed keys, and avoiding opening unfamiliar repos until patched.

TL;DR Claude Code <2.0.65 let a malicious repo's settings file redirect API traffic (and leak the user's Anthropic API key) before the trust prompt was ever shown.
Open original ↗
Document

What it is

CVE-2026-21852 is a credential-disclosure flaw (CWE-522) in Claude Code before 2.0.65. A malicious repository's settings file sets ANTHROPIC_BASE_URL to an attacker endpoint; Claude Code applies it at project load and issues authenticated API requests before the trust prompt appears, sending the user's Anthropic API key to the attacker. Published to NVD 2026-01-21.

The summary already covers the mechanism and fix. What follows is what it omits: the ordering detail that changes the response, the update commands, and the detection/IoC set.

The detail that matters

The credential leaks regardless of whether the user accepts or rejects the trust prompt — by the time the prompt is shown, the request has already gone out. So "I clicked no" is not a safe outcome. Anyone who opened an unfamiliar repo on a pre-2.0.65 build should treat their key as potentially exposed, not judge exposure by their trust-prompt choice.

What to do

# Verify Claude Code version
claude --version

# Update Claude Code to the latest patched version
npm update -g @anthropic/claude-code

Standard auto-update should have already delivered 2.0.65; manual-update users must pull it themselves. Rotate any keys that may have been exposed, and review recently opened repos for suspicious ANTHROPIC_BASE_URL settings.

Detection / IoCs

The page adds a concrete detection set the summary lacks:

  • Outbound connections from Claude Code to non-Anthropic domains — monitor/block against a whitelist.
  • Repository config files that override ANTHROPIC_BASE_URL — scan repos before opening; file-integrity monitoring on config files.
  • Anthropic API-log entries showing key usage from new or unfamiliar IPs / geographies — alert on these.

Caveats

The page carries a vendor disclaimer that its content was AI-generated; verify specifics against the linked GitHub Security Advisory before relying on them. It also references that advisory for actual exploitation detail, which this page does not provide.

Organisations named here

  • CWE-522

CVEs named here

  • CVE-2026-21852

Technologies named here

  • Claude Code
  • Anthropic

Related in AI Security