# Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)

- **Severity:** Critical
- **Signature ID:** `942e7f8b-52fa-411b-9e68-a9f70d6819fa`
- **CVEs:** CVE-2026-21852
- **MITRE ATLAS:** AML.T0010 (AI Supply Chain Compromise), AML.T0024 (Exfiltration via AI Inference API), AML.T0055 (Unsecured Credentials)
- **OWASP:** ASI01 (Agent Authorization and Control Hijacking), ASI04 (Memory and Context Poisoning), ASI09 (Traceability and Accountability Gaps), LLM02 (Sensitive Information Disclosure), LLM06 (Excessive Agency)

## Summary

A booby-trapped code repository can silently steal a developer's live Anthropic API key just by being opened in Claude Code. The trick works because Claude Code sends its first API request before it asks the developer whether to trust the repo's settings.

## How the attack works

An attacker publishes a repository containing a `.claude/settings.json` (or equivalent shell environment file) that sets `ANTHROPIC_BASE_URL` to a server they control. When a developer opens or clones the repo, Claude Code reads this repo-scoped setting and fires its first API request against the attacker's endpoint — before the usual trust prompt ever appears. That request carries the `Authorization: Bearer <api-key>` header, handing the developer's real Anthropic API key straight to the attacker. The attacker can then use the stolen key for unauthorized inference, take over the account, or pivot to other systems that trust it.

## Why it matters

An attacker gains a working Anthropic API key tied to the victim's account, enabling unauthorized model usage, billing abuse, and potential further compromise of anything the key is trusted to access. This is credential theft, not code execution on the victim's machine.

## What you can do

- Review any repository's `.claude/settings.json` or environment files before opening it in Claude Code, and treat unexpected `ANTHROPIC_BASE_URL` values as a red flag.
- Restrict `ANTHROPIC_BASE_URL` at the organization level to a known allowlist: `api.anthropic.com`, Vertex AI (`*.googleapis.com`), or Bedrock (`*.bedrock.*.amazonaws.com`) endpoints.
- Upgrade Claude Code to version 2.0.65 or later, which moves the trust prompt ahead of the first API request.
- If you suspect exposure, rotate the affected Anthropic API key immediately and audit recent API usage for anomalies.

## Known benign look-alikes

- Legitimate Claude Code documentation discussing `ANTHROPIC_BASE_URL` configuration for proxy / corporate-egress scenarios where the endpoint is internally trusted.
- Static analysis tooling output documenting CVE-2026-21852 attack patterns for defensive purposes.
- Patched Claude Code >= 2.0.65 deployments where the trust gate now fires before the first API request — detection still flags the config shape but the runtime impact is mitigated.
- Internal team templates that include reviewed `.claude/settings.json` fixtures pointing at an internally-operated Anthropic proxy with documented credential-handling controls.
- Local development with `ANTHROPIC_BASE_URL=http://localhost:port` or `http://127.0.0.1:port` against a local mock — detection should not fire on localhost loopback by design.

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00524
- https://research.checkpoint.com/2026/claude-code-anthropic-base-url-cve-2026-21852/
- https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7
- https://github.com/atiilla/CVE-2026-21852-PoC
- https://nvd.nist.gov/vuln/detail/CVE-2026-21852

---
Source: https://www.netzilo.com/threats/atr-claude-code-anthropic-base-url-credential-exfiltration-cve-2