# CVE-2026-21852: Anthropic Claude Code credential leakage via malicious environment configuration

Source: https://junglewise.ai/threats/cve-2026-21852-anthropic-claude-code-credential-leakage-via-malicious  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-21. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-21852 · Severity: medium · CVSS 4 · Published 2026-01-21

Claude Code is a developer tool that enables AI-assisted coding within repositories. A vulnerability allowed malicious repository settings to trigger API calls before users confirmed whether they trusted the repository, potentially exposing their Anthropic API credentials to an attacker-controlled server. An attacker who controls a repository could steal API keys from developers who open that repository in Claude Code.

Technologies: [Anthropic Claude Code](https://junglewise.ai/threats/technologies/claude-code), [@anthropic-ai/claude-code (npm)](https://junglewise.ai/threats/technologies/anthropic-ai-claude-code). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-21852 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-21852 being exploited in the wild.

**How severe is CVE-2026-21852?** Medium severity, with a CVSS score of 4, published 21 January 2026.

**Which products and versions are affected?** Anthropic Claude Code < 2.0.65; @anthropic-ai/claude-code (npm) SEMVER:introduced=0,fixed=2.0.65.

**Is there a fix for CVE-2026-21852?** Yes. @anthropic-ai/claude-code (npm): upgrade to 2.0.65 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-21852 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-21852?** Check whether you run Anthropic Claude Code or @anthropic-ai/claude-code (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @anthropic-ai/claude-code (npm): upgrade to 2.0.65 or later

  ```sh
  npm install @anthropic-ai/claude-code@2.0.65
  ```


## Technical details

The vulnerability stems from improper trust-confirmation ordering in Claude Code's project-load flow. When a user opens a repository containing a malicious `.env` or settings file that overrides ANTHROPIC_BASE_URL to an attacker-controlled endpoint, Claude Code would issue API requests (including the user's API key) before displaying the trust/confirmation prompt to the user. The attack requires the attacker to control a Git repository and the user to open it with Claude Code; no additional privileges or authentication are required. An attacker can exfiltrate credentials including Anthropic API keys. The vulnerability has been patched in version 2.0.65; auto-update users have already received the fix.

## Affected products

- Anthropic Claude Code < 2.0.65

## Identifiers

- CVE-2026-21852
- GHSA-jh7p-qr78-84p7

## Timeline

- 2026-01-21: disclosed
- 2026-01-21: patched: version 2.0.65

## References

- [https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7](https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7)

## Related threats

- [Anthropic Claude Code time-of-check-to-time-of-use in Edit tool](https://junglewise.ai/threats/cve-2026-88968-claude-code-is-an-agentic-coding-tool-prior-to-2-1-251-the-edit)
- [Anthropic Claude Code plugin hash pin bypass in git checkout](https://junglewise.ai/threats/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass-of-hash-pinning)
- [Anthropic Claude Code managed settings bypass with stored API key](https://junglewise.ai/threats/cve-2026-103012-claude-code-selected-an-api-key-stored-by-claude-code-for)
- [Anthropic Claude Code sandbox escape via git worktree path confusion](https://junglewise.ai/threats/cve-2026-55607-anthropic-claude-code-sandbox-escape-via-git-worktree-path)
- [Anthropic Claude Code insecure temporary file in copy command](https://junglewise.ai/threats/cve-2026-46406-anthropic-claude-code-insecure-temporary-file-in-copy-command)