ACVE-2026-0001

The configuration

Configuration label

claude-code <999.0.0 + scope=project

Affected entries

• AgentHarness: claude-code — SEMVER (introduced 0)

Matcher

• all
  • harness.id eq "claude-code"
  • harness.version semverRange "<999.0.0"
  • envKeysSet contains "ANTHROPIC_BASE_URL"
  • some settingsFiles
    • scope eq "project"

Why it is exploitable

What the vulnerability is

Claude Code project settings can expose credentials when a custom ANTHROPIC_BASE_URL is routed through a repository-controlled settings file. The concern is that a repository can influence where the harness sends authenticated requests. The affected and fixed Claude Code release boundary is not established by the current seed and remains provisional.

Which configuration is exposed

The matcher requires Claude Code, a harness version below the broad sentinel <999.0.0, the environment key ANTHROPIC_BASE_URL to be present, and at least one settingsFiles entry with scope project. Those are the exact conditions encoded. ACVE is not asserting a particular URL value; it reports the combination of a credential-routing key and a project-scoped settings file.

How ACVE detects it

ACVE reads harness.id, harness.version, envKeysSet, and settingsFiles[].scope. It does not read the value of ANTHROPIC_BASE_URL, the destination host, the credentials, or the contents and provenance of the settings file. The broad version sentinel means the finding is deliberately configuration-focused until a fixed release is grounded.

Fix

1. Remove ANTHROPIC_BASE_URL from project-scoped settings and keep credential-routing configuration in a user-controlled location.
2. Run grounding and upgrade Claude Code once a fixed release is confirmed.
3. Rebuild the lockfile and verify that the project settings file no longer supplies the key.

Grounding needed

acve advisory ground must confirm the Claude Code affected range, fixed release, and that the CVE-2026-21852 alias and package mapping refer to this project-settings credential-exposure issue.

Do not put a secret or credential value in the project file while this configuration is under review.

References

See references for primary sources.

Underlying CVEs / aliases

• CVE-2026-21852

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Remove the project-scoped base URL and upgrade after the fixed release is confirmed.

Validation

No validation entries recorded.

Grounding

• OSV: not found; checked-at 2026-09-20T02:43:27Z
• NVD: not found; checked-at 2026-09-20T02:43:27Z
• KEV: not listed in KEV; checked-at 2026-09-20T02:43:27Z

References

ADVISORY

• https://nvd.nist.gov/vuln/detail/CVE-2026-21852

REPORT

• https://example.com/research/acve

FIX

• https://github.com/pickbitsai/acve/issues?q=CVE-2026-21852