Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. An attacker-controlled repository could include a settings file that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code would read the configuration and immediately issue API requests before showing the trust prompt, potentially leaking the user's API keys. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch, or to the latest version.

The version of Anthropic Claude Code installed on the remote host is prior to 2.0.65. It is, therefore, affected by an information disclosure vulnerability.

A vulnerability in the project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. If a user started Claude Code in an attacker-controlled repository, and the repository included a settings file that set ANTHROPIC_BASE_URL to an attacker-controlled endpoint, Claude Code would issue API requests before showing the trust prompt, potentially leaking the user's API keys. (CVE-2026-21852)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Claude Code is an agentic coding tool. Prior to version 2.0.65, vulnerability in Claude Code's project-
    load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users
    confirmed trust. An attacker-controlled repository could include a settings file that sets
    ANTHROPIC_BASE_URL to an attacker-controlled endpoint and when the repository was opened, Claude Code
    would read the configuration and immediately issue API requests before showing the trust prompt,
    potentially leaking the user's API keys. Users on standard Claude Code auto-update have received this fix
    already. Users performing manual updates are advised to update to version 2.0.65, which contains a patch,
    or to the latest version. (CVE-2026-21852)

ID	Name	Product	Family	Severity
305985	Anthropic Claude Code < 2.0.65 API Key Leak via Project Settings (CVE-2026-21852)	Nessus	Misc.	medium
436827	SCA: security update for @anthropic-ai/claude-code (GHSA-jh7p-qr78-84p7)	Tenable Cloud Security	SCA Checks	medium
436827	SCA: security update for @anthropic-ai/claude-code (GHSA-jh7p-qr78-84p7)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2026-21852

medium

Tenable Plugins

medium

medium

medium