Claude Code RCE & API Key Exfiltration — CVE-2025-59536 + CVE-2026-21852, Untrusted Repo Attack Surface via Hooks, MCP Servers & Environment Variables

Claude Code RCE & API Key Exfiltration (TL-2026-0146), also tracked as GHSA-4fgq-fpq9-mr3g, is a high-severity software vulnerability scored CVSS 8.8, first published 2026-02-26. It has no confirmed attribution, affects Anthropic Claude Code, references 2 CVEs (CVE-2025-59536, CVE-2026-21852), maps to 16 MITRE ATT&CK techniques (T1036.005, T1041, T1056), and is covered by 9 detection rules and 12 indicators of compromise.

Key facts for TL-2026-0146

Threat ID
TL-2026-0146
Also known as
GHSA-4fgq-fpq9-mr3g, GHSA-jh7p-qr78-84p7, GHSA-ph6w-f82w-28w6
Severity
HIGH
CVSS
8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Status
SUPERSEDED
Category
VULNERABILITY
First published
2026-02-26
Last reviewed
2026-02-26
Attribution confidence
NONE
Target sectors
technology, software-development, enterprise, open-source
Target regions
Global
Detection rules
9
Indicators of compromise
12

Malware and tooling in Claude Code RCE & API Key Exfiltration

Malware and tooling: Claude Code

Multiple vulnerabilities in Anthropic's Claude Code AI coding assistant allow remote code execution and API key theft when developers clone and open untrusted repositories. CVE-2025-59536 (CVSS 8.8) enables code injection via malicious MCP server configurations that bypass user consent through project-level enableAllProjectMcpServers settings. CVE-2026-21852 (CVSS 7.5) exfiltrates Anthropic API keys via ANTHROPIC_BASE_URL override before the trust dialog appears. A third flaw (GHSA-ph6w-f82w-28w6, no CVE) bypasses consent via project hooks executing shell commands on session start. All three are patched but represent a critical new attack surface in AI-assisted development tooling.

How Claude Code RCE & API Key Exfiltration works

Check Point Research (Aviv Donenfeld and Oded Vanunu) discovered three vulnerabilities in Anthropic's Claude Code, an AI-powered command-line coding assistant, that expose developers to remote code execution and credential theft through malicious Git repositories.

Vulnerability #1 — RCE via Untrusted Project Hooks (GHSA-ph6w-f82w-28w6, no CVE assigned, CVSS 8.7 v4.0): Claude Code supports project-level hooks defined in .claude/settings.json that execute shell commands at lifecycle events (SessionStart, PreToolUse, PostToolUse). These hooks are repository-controlled — any contributor with commit access can define hooks that execute on every collaborator's machine. When a user runs 'claude' in a project directory and clicks 'Yes, proceed' on the trust dialog, hook commands execute immediately without additional confirmation. The trust dialog mentions files may be executed 'with your permission' but does not warn that hook commands run automatically. Check Point demonstrated a reverse shell via a SessionStart hook. Fixed in Claude Code v1.0.87 (September 2025).

Vulnerability #2 — RCE via MCP User Consent Bypass (CVE-2025-59536, CVSS 8.8 NVD v3.1): Claude Code initializes MCP (Model Context Protocol) servers defined in .mcp.json configuration files when opening a conversation. After the hooks vulnerability disclosure, Anthropic added an improved dialog warning about .mcp.json command execution. However, the enableAllProjectMcpServers and enabledMcpjsonServers settings in .claude/settings.json can auto-approve MCP servers without user consent. When both .mcp.json (defining a malicious MCP server) and .claude/settings.json (with enableAllProjectMcpServers: true) are present in a repo, the malicious command executes immediately upon running claude — before the user can even read the trust dialog. The calculator app opened on top of the pending trust dialog in Check Point's demonstration. Escalated to reverse shell. Fixed in Claude Code v1.0.111 (October 2025).

Vulnerability #3 — API Key Exfiltration via ANTHROPIC_BASE_URL (CVE-2026-21852, CVSS 7.5 NVD v3.1): The ANTHROPIC_BASE_URL environment variable controls the endpoint for all Claude Code API communications. This variable can be overridden in .claude/settings.json. When set to an attacker-controlled endpoint, Claude Code sends API requests — including the Authorization header with the full Anthropic API key in plaintext — before showing the trust dialog. No user interaction required beyond running 'claude' in the repository directory. Beyond billing fraud, stolen API keys grant access to Claude Workspaces, where multiple developers share files. Check Point demonstrated bypassing the download restriction on uploaded files by using the code execution tool to regenerate files as downloadable artifacts, achieving full read/write access to all workspace files. Fixed in Claude Code v2.0.65 (January 2026).

The attack surface is the untrusted Git repository: an attacker poisons a repo with .claude/settings.json and .mcp.json, then waits for developers to clone and run Claude Code. This is particularly dangerous in open-source ecosystems where developers routinely clone and explore repositories. The three vulnerabilities together represent a novel attack class targeting AI coding assistants through configuration file abuse.

MITRE ATT&CK techniques used in TL-2026-0146

defense-evasion

T1036.005 Match Legitimate Resource Name or Location

exfiltration

T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service

collection

T1056 Input Capture; T1530 Data from Cloud Storage

execution

T1059.004 Unix Shell; T1204.002 Malicious File; T1559 Inter-Process Communication

command-and-control

T1071.001 Web Protocols

initial-access

T1195.001 Compromise Software Dependencies and Development Tools; T1199 Trusted Relationship

impact

T1496 Resource Hijacking

credential-access

T1528 Steal Application Access Token; T1552.001 Credentials In Files

privilege-escalation

T1546 Event Triggered Execution

defense-impairment

T1553 Subvert Trust Controls

Affected products and versions in Claude Code RCE & API Key Exfiltration

  • Anthropic — Claude Code
    Vulnerable versions: < 1.0.87 (hooks bypass); < 1.0.111 (MCP RCE, CVE-2025-59536); < 2.0.65 (API key exfil, CVE-2026-21852)
    Fixed in: 1.0.87; 1.0.111; 2.0.65

Remediation for Claude Code RCE & API Key Exfiltration

Patches

  • Claude Code v1.0.87 — Hooks consent bypass fix (September 2025)
  • Claude Code v1.0.111 — MCP server RCE fix, CVE-2025-59536 (October 2025)
  • Claude Code v2.0.65 — API key exfiltration fix, CVE-2026-21852 (January 2026)

Immediate actions

  • Update Claude Code to latest version (>= v2.0.65) immediately
  • Audit .claude/settings.json and .mcp.json in all repositories for unauthorized hooks, MCP servers, or environment variable overrides
  • Never run 'claude' in untrusted or newly cloned repositories without first inspecting .claude/ directory and .mcp.json
  • Rotate Anthropic API keys if Claude Code was used in untrusted repositories prior to patches
  • Review Claude Workspace files for unauthorized access or modifications

Workarounds

  • Disable auto-update and pin to known-patched version
  • Remove .claude/ directory and .mcp.json from untrusted repositories before running Claude Code
  • Set ANTHROPIC_BASE_URL as a system-level environment variable to prevent project-level override

Longer-term hardening

  • Implement repository security scanning to detect malicious .claude/settings.json and .mcp.json configurations
  • Enforce organizational policies against enableAllProjectMcpServers in project settings
  • Use API key scoping and rotation policies for Claude Code deployments
  • Monitor API usage for anomalous ANTHROPIC_BASE_URL redirections
  • Add .claude/settings.json and .mcp.json to code review checklists for supply chain security

CVEs associated with Claude Code RCE & API Key Exfiltration

CVE-2025-59536, CVE-2026-21852

Weaknesses (CWE) in Claude Code RCE & API Key Exfiltration

CWE-94, CWE-522, CWE-829

Timeline of Claude Code RCE & API Key Exfiltration

  • Anthropic patches hooks consent bypass (GHSA-ph6w-f82w-28w6) in Claude Code v1.0.87. Improved trust dialog added but does not fully mitigate MCP vector.
  • Anthropic patches CVE-2025-59536 (MCP server RCE via enableAllProjectMcpServers consent bypass) in Claude Code v1.0.111. GHSA-4fgq-fpq9-mr3g published.
  • NVD publishes CVE-2025-59536 with CVSS 8.8 (v3.1). Rated HIGH severity. CWE-94 (Code Injection).
  • Anthropic patches CVE-2026-21852 (API key exfiltration via ANTHROPIC_BASE_URL override) in Claude Code v2.0.65. GHSA-jh7p-qr78-84p7 published.
  • NVD publishes CVE-2026-21852 with CVSS 7.5 (v3.1). CWE-522 (Insufficiently Protected Credentials). NVD rates UI:N (no user interaction required for key leak).
  • Check Point Research publishes full technical writeup of all three vulnerabilities. The Hacker News covers the story. PoC details and attack demonstrations included.
  • Threadlinqs Intelligence publishes TL-2026-0146 with full MITRE mapping, detection rules, and simulation coverage for Claude Code attack vectors.
  • As of 2026-05-29, the three original Claude Code flaws (CVE-2025-59536, CVE-2026-21852, GHSA-ph6w-f82w-28w6) remain patched (v1.0.111/v2.0.65) and absent from CISA KEV. But the same project-settings attack vector is superseded by still-active successors: Adversa AI's unpatched "TrustFall" 1-click RCE (May 7) reusing enableAllProjectMcpServers, plus the v2.1.88 source leak and claude-cli:// deeplink RCE (patched v2.1.118).

Sources cited for Claude Code RCE & API Key Exfiltration

Threats related to Claude Code RCE & API Key Exfiltration

Detection coverage for TL-2026-0146

As of 2026-02-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0146 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats