{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0001",
  "aliases": [
    "CVE-2026-21852"
  ],
  "published": "2026-09-19T00:00:00Z",
  "modified": "2026-09-19T00:00:00Z",
  "summary": "Claude Code project settings can expose credentials through a custom base URL",
  "details": "## What the vulnerability is\n\nClaude Code project settings can expose credentials when a custom `ANTHROPIC_BASE_URL` is routed through a repository-controlled settings file. The concern is that a repository can influence where the harness sends authenticated requests. The affected and fixed Claude Code release boundary is not established by the current seed and remains provisional.\n\n## Which configuration is exposed\n\nThe matcher requires Claude Code, a harness version below the broad sentinel `<999.0.0`, the environment key `ANTHROPIC_BASE_URL` to be present, and at least one `settingsFiles` entry with `scope` `project`. Those are the exact conditions encoded. ACVE is not asserting a particular URL value; it reports the combination of a credential-routing key and a project-scoped settings file.\n\n## How ACVE detects it\n\nACVE reads `harness.id`, `harness.version`, `envKeysSet`, and `settingsFiles[].scope`. It does not read the value of `ANTHROPIC_BASE_URL`, the destination host, the credentials, or the contents and provenance of the settings file. The broad version sentinel means the finding is deliberately configuration-focused until a fixed release is grounded.\n\n## Fix\n\n1. Remove `ANTHROPIC_BASE_URL` from project-scoped settings and keep credential-routing configuration in a user-controlled location.\n2. Run grounding and upgrade Claude Code once a fixed release is confirmed.\n3. Rebuild the lockfile and verify that the project settings file no longer supplies the key.\n\n## Grounding needed\n\n`acve advisory ground` must confirm the Claude Code affected range, fixed release, and that the `CVE-2026-21852` alias and package mapping refer to this project-settings credential-exposure issue.\n\nDo not put a secret or credential value in the project file while this configuration is under review.\n\n## References\n\nSee `references` for primary sources.",
  "affected": [
    {
      "package": {
        "ecosystem": "AgentHarness",
        "name": "claude-code"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21852"
    },
    {
      "type": "REPORT",
      "url": "https://example.com/research/acve"
    },
    {
      "type": "FIX",
      "url": "https://github.com/pickbitsai/acve/issues?q=CVE-2026-21852"
    }
  ],
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "8"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "vulnClasses": [
        "credential-exposure"
      ],
      "cwe": [
        "CWE-522"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI06 Sensitive Information Disclosure"
        ],
        "atlas": [
          "AML.T0051"
        ]
      },
      "matcher": {
        "all": [
          {
            "field": "harness.id",
            "op": "eq",
            "value": "claude-code"
          },
          {
            "field": "harness.version",
            "op": "semverRange",
            "value": "<999.0.0"
          },
          {
            "field": "envKeysSet",
            "op": "contains",
            "value": "ANTHROPIC_BASE_URL"
          },
          {
            "some": "settingsFiles",
            "where": {
              "field": "scope",
              "op": "eq",
              "value": "project"
            }
          }
        ]
      },
      "fix": {
        "summary": "Remove the project-scoped base URL and upgrade after the fixed release is confirmed.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "settings:claude-code:ANTHROPIC_BASE_URL",
            "to": "unset",
            "why": "Do not place credential-routing settings in a repository-controlled file."
          }
        ]
      },
      "exposure": "local",
      "exploitation": {
        "vector": "malicious project or server configuration",
        "userInteraction": "required",
        "kev": false
      },
      "grounding": {
        "osv": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "found": false,
          "aliasesConfirmed": [],
          "packagesConfirmed": [],
          "fixedVersionsConfirmed": [],
          "cvss": []
        },
        "nvd": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "found": false,
          "cvss": null,
          "published": null
        },
        "kev": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "listed": false
        },
        "registry": {
          "checkedAt": "2026-09-20T02:43:27Z",
          "confirmed": [],
          "missing": []
        }
      }
    }
  }
}