# Claude Code RCE & API Key Exfiltration — CVE-2025-59536 + CVE-2026-21852, Untrusted Repo Attack Surface via Hooks, MCP Servers & Environment Variables

> Multiple vulnerabilities in Anthropic's Claude Code AI coding assistant allow remote code execution and API key theft when developers clone and open untrusted repositories. CVE-2025-59536 (CVSS 8.8) enables code injection via malicious MCP server configurations that bypass user consent through project-level enableAllProjectMcpServers settings. CVE-2026-21852 (CVSS 7.5) exfiltrates Anthropic API keys via ANTHROPIC_BASE_URL override before the trust dialog appears. A third flaw (GHSA-ph6w-f82w-28w6, no CVE) bypasses consent via project hooks executing shell commands on session start. All three are patched but represent a critical new attack surface in AI-assisted development tooling.

- **Published:** 2026-02-26T12:00:00Z
- **Last reviewed:** 2026-02-26T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0146
- **ID:** TL-2026-0146
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** SUPERSEDED
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-59536, CVE-2026-21852

## Description

Check Point Research (Aviv Donenfeld and Oded Vanunu) discovered three vulnerabilities in Anthropic's Claude Code, an AI-powered command-line coding assistant, that expose developers to remote code execution and credential theft through malicious Git repositories.

Vulnerability #1 — RCE via Untrusted Project Hooks (GHSA-ph6w-f82w-28w6, no CVE assigned, CVSS 8.7 v4.0): Claude Code supports project-level hooks defined in .claude/settings.json that execute shell commands at lifecycle events (SessionStart, PreToolUse, PostToolUse). These hooks are repository-controlled — any contributor with commit access can define hooks that execute on every collaborator's machine. When a user runs 'claude' in a project directory and clicks 'Yes, proceed' on the trust dialog, hook commands execute immediately without additional confirmation. The trust dialog mentions files may be executed 'with your permission' but does not warn that hook commands run automatically. Check Point demonstrated a reverse shell via a SessionStart hook. Fixed in Claude Code v1.0.87 (September 2025).

Vulnerability #2 — RCE via MCP User Consent Bypass (CVE-2025-59536, CVSS 8.8 NVD v3.1): Claude Code initializes MCP (Model Context Protocol) servers defined in .mcp.json configuration files when opening a conversation. After the hooks vulnerability disclosure, Anthropic added an improved dialog warning about .mcp.json command execution. However, the enableAllProjectMcpServers and enabledMcpjsonServers settings in .claude/settings.json can auto-approve MCP servers without user consent. When both .mcp.json (defining a malicious MCP server) and .claude/settings.json (with enableAllProjectMcpServers: true) are present in a repo, the malicious command executes immediately upon running claude — before the user can even read the trust dialog. The calculator app opened on top of the pending trust dialog in Check Point's demonstration. Escalated to reverse shell. Fixed in Claude Code v1.0.111 (October 2025).

Vulnerability #3 — API Key Exfiltration via ANTHROPIC_BASE_URL (CVE-2026-21852, CVSS 7.5 NVD v3.1): The ANTHROPIC_BASE_URL environment variable controls the endpoint for all Claude Code API communications. This variable can be overridden in .claude/settings.json. When set to an attacker-controlled endpoint, Claude Code sends API requests — including the Authorization header with the full Anthropic API key in plaintext — before showing the trust dialog. No user interaction required beyond running 'claude' in the repository directory. Beyond billing fraud, stolen API keys grant access to Claude Workspaces, where multiple developers share files. Check Point demonstrated bypassing the download restriction on uploaded files by using the code execution tool to regenerate files as downloadable artifacts, achieving full read/write access to all workspace files. Fixed in Claude Code v2.0.65 (January 2026).

The attack surface is the untrusted Git repository: an attacker poisons a repo with .claude/settings.json and .mcp.json, then waits for developers to clone and run Claude Code. This is particularly dangerous in open-source ecosystems where developers routinely clone and explore repositories. The three vulnerabilities together represent a novel attack class targeting AI coding assistants through configuration file abuse.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1199 Trusted Relationship
- T1059.004 Unix Shell
- T1204.002 Malicious File
- T1559 Inter-Process Communication
- T1546 Event Triggered Execution
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1056 Input Capture
- T1553 Subvert Trust Controls
- T1036.005 Match Legitimate Resource Name or Location
- T1530 Data from Cloud Storage
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1071.001 Web Protocols
- T1496 Resource Hijacking

## Sources

- [Check Point Research — RCE and API Token Exfiltration Through Claude Code Project Files](https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/)
- [Check Point Blog — Critical Claude Code Flaws Exposed](https://blog.checkpoint.com/research/check-point-researchers-expose-critical-claude-code-flaws/)
- [GHSA-4fgq-fpq9-mr3g — CVE-2025-59536 Code Injection via MCP Server Config](https://github.com/anthropics/claude-code/security/advisories/GHSA-4fgq-fpq9-mr3g)
- [GHSA-jh7p-qr78-84p7 — CVE-2026-21852 API Key Exfiltration](https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7)
- [GHSA-ph6w-f82w-28w6 — Hooks Consent Bypass (No CVE)](https://github.com/anthropics/claude-code/security/advisories/GHSA-ph6w-f82w-28w6)
- [NVD: CVE-2025-59536 — Claude Code Code Injection (CVSS 8.8)](https://nvd.nist.gov/vuln/detail/CVE-2025-59536)
- [NVD: CVE-2026-21852 — Claude Code API Key Exfiltration (CVSS 7.5)](https://nvd.nist.gov/vuln/detail/CVE-2026-21852)
- [The Hacker News — Claude Code Flaws Allow RCE and API Key Exfiltration](https://thehackernews.com/2026/02/claude-code-flaws-allow-remote-code.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0146