CVE-2026-21852

Claude Code versions prior to 2.0.65 process repository settings during the project-load flow before the user has confirmed trust in a repository, and this flaw (CWE-522, insufficiently protected credentials) lets a malicious repository redirect API traffic and capture credentials. When a user opens an attacker-controlled repository, Claude Code reads a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and immediately issues API requests before the trust prompt is shown. Because those requests are sent to the attacker's endpoint, the user's Anthropic API key can be leaked to the attacker. Anyone running an affected version of Anthropic Claude Code who opens untrusted or attacker-supplied repositories is affected, while users on standard auto-update have already received the fix. No public proof-of-concept or confirmed in-the-wild exploitation is known and the flaw is not on CISA's KEV list, but EPSS assigns a 24.8% probability of exploitation within 30 days (98th percentile).

What to do: Upgrade to Claude Code 2.0.65 or later; auto-update users have already received the fix, so manually verify the installed version if updates are managed by hand. Until patched, avoid opening untrusted repositories with Claude Code, and review repository settings files for ANTHROPIC_BASE_URL overrides before trusting a project. Check API usage logs or billing for unexpected requests to unfamiliar endpoints and rotate the Anthropic API key if exposure is suspected.