# CVE-2026-21852: CVE-2026-21852: Claude Code API Key Exfiltration via Malicious Repository Config

> CVE-2026-21852 is a high-severity credential theft issue in Claude Code, an AI agent. Affected: Claude Code < 2.0.65. Fixed in 2.0.65.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-21852
- **Aliases:** ti-006
- **Severity:** high
- **Attack type:** Credential theft, Data exfiltration
- **Component:** Claude Code (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-02-25
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-21852

## Summary

Claude Code's project-load flow issued API requests, including auth headers, to ANTHROPIC_BASE_URL before showing a trust prompt, allowing a malicious repo's settings file to silently redirect all API calls to an attacker server and steal the developer's Anthropic API key. Discovered by Check Point Research; fixed in Claude Code v2.0.65 in January 2026.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Claude Code < 2.0.65 | 2.0.65 |

## Am I affected by CVE-2026-21852?

You are affected if you run Claude Code < 2.0.65. Versions 2.0.65 and later include the fix.

## How do I fix CVE-2026-21852?

Upgrade Claude Code to v2.0.65+. Rotate Anthropic API keys if Claude Code was used on untrusted repos prior to patch. Block ANTHROPIC_BASE_URL overrides in project-scoped settings.

## How do I find every machine running Claude Code?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Code and which version, then enforce a policy on it.

## References

- article: https://thehackernews.com/2026/02/claude-code-flaws-allow-remote-code.html
- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-21852

## Related vulnerabilities

- [CVE-2026-54316](https://catalog.anomity.ai/vuln/cve-2026-54316) — high
- [a-repo-defined-claude-code-subagent-downgraded-its-own-security-review](https://catalog.anomity.ai/vuln/a-repo-defined-claude-code-subagent-downgraded-its-own-security-review) — medium
- [plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code](https://catalog.anomity.ai/vuln/plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code) — critical
- [claude-code-silently-patched-five-permission-and-hook-bypasses-across-2](https://catalog.anomity.ai/vuln/claude-code-silently-patched-five-permission-and-hook-bypasses-across-2) — high
- [CVE-2026-46406](https://catalog.anomity.ai/vuln/cve-2026-46406) — medium
- [CVE-2025-59536](https://catalog.anomity.ai/vuln/cve-2025-59536) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-21852