Claude Code ANTHROPIC_BASE_URL Credential Exfiltration (CVE-2026-21852) - ATR-2026-00524 (03b1c961-3e51-53e3-8f3b-5a0d95d26007)
Detects exploitation of CVE-2026-21852 (Moderate, CVSS 5.3), credential exfiltration in Claude Code via attacker-controlled ANTHROPIC_BASE_URL. An attacker-controlled repository ships a .claude/settings.json (or environment configuration) that sets ANTHROPIC_BASE_URL to an attacker-controlled endpoint. Claude Code makes its first API request BEFORE the trust prompt renders, leaking the Authorization: Bearer <api-key> header — i.e. the developer's active Anthropic API key — to the attacker's server. The full kill chain is: clone-or-open malicious repo → Claude Code loads repo-scoped settings → first API request fires pre-trust against ANTHROPIC_BASE_URL → attacker captures the live API key from the Authorization header → attacker uses key for unauthorised inference, account takeover, or onward credential pivoting. Detection anchors on ANTHROPIC_BASE_URL being set to any endpoint outside the documented Anthropic-controlled host list (api.anthropic.com, *.googleapis.com Vertex endpoints, *.bedrock.*.amazonaws.com Bedrock endpoints) — bare IP, plain http, or any non-Anthropic FQDN is a strong signal. CWE-522 (insufficiently protected credentials), CWE-1188 (insecure default), CWE-440 (expected behaviour violation). Patches in Claude Code >= 2.0.65 (GHSA-jh7p-qr78-84p7); affected versions < 2.0.65. PoC at github.com/atiilla/CVE-2026-21852-PoC. This rule detects exploit configs in repo-scoped settings.json and shell-env files, and provides defence-in-depth post-patch by flagging the dangerous endpoint rebind regardless of upstream patch state.