Security readout for executives and security teams
Plain-English summary
Claude Code before 2.0.65 could leak Anthropic API keys when a user opened a malicious repository. The issue happened before the user confirmed they trusted the project. Standard auto-update users should already have the fix, but manually updated installations need attention.
Executive priority
Prioritize as a near-term developer workstation and credential-protection issue. It is not described as actively exploited, but leaked API keys can create operational and financial risk. Manual-update environments should verify remediation promptly.
Technical view
A malicious repository could include configuration setting ANTHROPIC_BASE_URL to an attacker-controlled endpoint. During project load, Claude Code read the configuration and made API requests before displaying the trust prompt, potentially exposing API keys. Affected versions are Claude Code prior to 2.0.65. The reported weakness is CWE-522.
Likely exposure
Exposure is most likely for developers using Claude Code versions below 2.0.65 who open untrusted or attacker-controlled repositories. Organizations using standard auto-update are likely already updated, per the advisory. Manual-update users remain the main concern.
Exploitation context
The CVSS vector indicates network attackability, low complexity, no privileges required, and user interaction required. The source bundle does not indicate known active exploitation, and the CVE is not listed as KEV. Impact is centered on credential exposure and limited confidentiality, integrity, and availability effects.
Researcher notes
The key security boundary failure is project configuration being honored before trust confirmation. Evidence is limited to the CVE record and GitHub advisory. No public exploit status, broader affected products, or alternative mitigations are provided in the supplied sources.
Mitigation direction
- Update Claude Code to version 2.0.65 or the latest available version.
- Confirm manually managed developer systems are not running versions below 2.0.65.
- Treat repositories from unknown sources as untrusted until updates are verified.
- If exposure is suspected, review vendor guidance on Anthropic API key rotation.
Validation and detection
- Inventory Claude Code installations and record installed versions.
- Identify systems not using standard Claude Code auto-update.
- Check whether any developer opened untrusted repositories with vulnerable versions.
- Review logs for unexpected Anthropic API traffic destinations, where available.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-522: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-21852 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficiently Protected Credentials
Insufficiently Protected Credentials represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.