HighVulnerabilityLLM-specific

CVE-2026-21852: Claude Code project-load flow leaks API keys before trust prompt

Source: NVD(opens in a new tab)
Identifier: CVE-2026-21852
Published: January 21, 2026
Record updated: October 22, 2026

Affected: @anthropic-ai/claude-code < 2.0.65
Fixed in: 2.0.65
released December 10, 2025, 42 days before disclosure
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 27.5%

Summary

Prior to version 2.0.65, Claude Code's project-load flow let a malicious repository exfiltrate data, including Anthropic API keys, before the user confirmed trust. A repository settings file could set ANTHROPIC_BASE_URL to an attacker-controlled endpoint, and Claude Code issued API requests on opening the repository, before the trust prompt appeared.

Mitigation

Fixed in 2.0.65, which contains a patch. Users on standard auto-update have already received the fix; users performing manual updates should update to version 2.0.65 or the latest version.

Details

Scores and exploitation

CVSS score: 7.5(high)
Patch available: Yes
EPSS: 27.5%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on November 4, 2026.

Weaknesses and techniques

Weakness (CWE): CWE-522

Affected

Packages: @anthropic-ai/claude-code@< 2.0.65 (fixed: 2.0.65)
Vendors: Anthropic

Classification

Attack type: Other
Attack sophistication: Trivial
AI component targeted: API
Impact: Confidentiality
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative. The source gives this advisory a description and no title, so the title above is a headline generated from the source text.

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-21852

First tracked: February 15, 2026 at 08:50 PM ET, from NVD/CVE Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 95% (self-assessed)

Coverage

News, research and other items that mention CVE-2026-21852.

Is Claude Code safe for the enterprise? What the official settings cover, and what they don'tAdversa AI Blog · 2026-10-22

Topics

AI agents

Summary

Mitigation

Coverage

Topics

Related items