CVE-2026-21852, published by NVD on January 21, 2026, is a credential-exfiltration vulnerability in Anthropic's Claude Code agentic coding tool that allowed malicious repositories to steal Anthropic API keys before the user had a chance to confirm trust. In versions prior to 2.0.65, an attacker-controlled repository could include a settings file that set ANTHROPIC_BASE_URL to an endpoint of the attacker's choosing; when the repository was opened, Claude Code's project-load flow read the configuration and immediately issued API requests to that endpoint ahead of the trust prompt, potentially leaking the user's API key to the attacker. The flaw was assigned CWE-522 (Insufficiently Protected Credentials), with GitHub as CNA scoring it CVSS 4.0 base 5.3 (Medium) and NIST adding a CVSS 3.1 base score of 7.5 (High) on February 2, 2026. Anthropic shipped a patch in Claude Code 2.0.65; users on the standard auto-update channel received the fix automatically, and those performing manual updates were advised to upgrade to 2.0.65 or later. The advisory is tracked as GHSA-jh7p-qr78-84p7.

Sources

• -https://nvd.nist.gov/vuln/detail/CVE-2026-21852