# CVE-2026-54316: CVE-2026-54316: Claude Code Pre-Approved huggingface.co, Turning a Download Counter Into an Exfiltration Channel

> CVE-2026-54316 is a high-severity credential theft issue in Claude Code, an AI agent. Affected: Claude Code 0.2.54 to 2.1.162. Fixed in 2.1.163.

- **Canonical URL:** https://catalog.anomity.ai/vuln/cve-2026-54316
- **Aliases:** ti-072
- **Severity:** high
- **Attack type:** Credential theft, Data exfiltration
- **Component:** Claude Code (AI agent)
- **Exploited in the wild:** no known exploitation
- **Published:** 2026-08-07
- **Last verified:** 2026-11-01
- **JSON:** https://catalog.anomity.ai/api/entries/vuln/cve-2026-54316

## Summary

Claude Code shipped huggingface.co as a bare pre-approved hostname for the WebFetch tool, so every path on that domain, including attacker-controlled model repositories, was fetched with no permission prompt and outside any --allowedTools restriction. Novee Security used the public download counter on those repositories as a covert channel, leaking an API key one character at a time out of any session that had untrusted content in context. Present in every release from 0.2.54 to 2.1.162 and fixed in 2.1.163; Anthropic scores it 6.0 under CVSS v4 while the NVD v3.1 vector puts it at 9.1.

## Affected versions

| Affected | Fixed in |
| --- | --- |
| Claude Code 0.2.54 to 2.1.162 | 2.1.163 |

## Am I affected by CVE-2026-54316?

You are affected if you run Claude Code 0.2.54 to 2.1.162. Versions 2.1.163 and later include the fix.

## How do I fix CVE-2026-54316?

Upgrade Claude Code to 2.1.163 or later and enforce it as a fleet minimum. Rotate Anthropic API keys used on machines that ran untrusted repositories before the patch. Then audit your own allowlists for bare hostnames: approving a domain approves every path on it, including pages any member of the public can upload.

## How do I find every machine running Claude Code?

Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Claude Code and which version, then enforce a policy on it.

## References

- cve: https://nvd.nist.gov/vuln/detail/CVE-2026-54316

## Related vulnerabilities

- [CVE-2026-21852](https://catalog.anomity.ai/vuln/cve-2026-21852) — high
- [a-repo-defined-claude-code-subagent-downgraded-its-own-security-review](https://catalog.anomity.ai/vuln/a-repo-defined-claude-code-subagent-downgraded-its-own-security-review) — medium
- [plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code](https://catalog.anomity.ai/vuln/plugin4shell-sha-pinning-bypass-gives-zero-click-rce-across-claude-code) — critical
- [claude-code-silently-patched-five-permission-and-hook-bypasses-across-2](https://catalog.anomity.ai/vuln/claude-code-silently-patched-five-permission-and-hook-bypasses-across-2) — high
- [CVE-2026-46406](https://catalog.anomity.ai/vuln/cve-2026-46406) — medium
- [CVE-2025-59536](https://catalog.anomity.ai/vuln/cve-2025-59536) — critical

---

Source: Anomity Security Database (https://catalog.anomity.ai/vuln). Detect affected AI tools on developer devices: https://anomity.ai/?utm_source=catalog&utm_medium=vuln-md&utm_campaign=cve-2026-54316