VulnerabilitiesHIGH

Critical RCE Vulnerabilities Found in Claude Code Project Files

CPCheck Point ResearchFeb 25, 2026
CVE-2025-59536CVE-2026-21852Claude CodeAnthropic
🎯

Basically, attackers can run harmful commands and steal sensitive data from Claude Code.

Quick Summary

Critical vulnerabilities have been found in Anthropic’s Claude Code, allowing attackers to execute remote commands and steal API tokens. This poses a serious risk to developers and companies using the platform. Immediate action is needed to secure configurations and protect sensitive data.

What Happened

A significant security threat has emerged with the discovery of critical vulnerabilities in Anthropic’s Claude Code. Researchers from Check Point have revealed that these flaws allow attackers to execute remote code and exfiltrate API tokens?. This means that malicious actors can potentially take control of systems and access sensitive information without authorization.

The vulnerabilities are linked to various configuration mechanisms? used in Claude Code, including Hooks? and Model Context Protocol (MCP)? servers. By manipulating these configurations, attackers can execute arbitrary shell commands, leading to severe security breaches. As the reliance on cloud-based systems grows, this discovery raises urgent questions about the safety of our digital environments.

Why Should You Care

If you use Claude Code or similar platforms, this is a wake-up call for you. Your API tokens are like keys to your digital home; if they fall into the wrong hands, attackers can unlock sensitive data, manipulate your projects, or even disrupt your business operations. Think of it like leaving your front door open — anyone can walk in and take what they want.

This vulnerability not only affects individual developers but also companies that rely on Claude Code for their projects. If your organization is using this platform, you could be at risk of data breaches, service disruptions, or even financial loss. Protecting your API tokens and configurations is now more critical than ever.

What's Being Done

In response to these vulnerabilities, security experts are urging users to take immediate action. Here are some steps you should consider:

  • Review and update your configurations in Claude Code to ensure they're secure.
  • Monitor your systems for any unauthorized access or unusual activity.
  • Educate your team about the importance of API token security and proper configuration management.

Experts are closely monitoring the situation for any signs of active exploitation. As the threat landscape evolves, staying informed and proactive will be essential to safeguard your digital assets.

💡 Tap dotted terms for explanations

🔒 Pro insight: The exploitation of these vulnerabilities could lead to widespread attacks, particularly targeting cloud environments reliant on API integrations.

Original article from

Check Point Research · samanthar@checkpoint.com

Read Full Article

Related Pings

HIGHVulnerabilities

Authentication Bypass Flaw Exposes pac4j-jwt Users

A critical vulnerability in the pac4j-jwt library allows attackers to impersonate users. Developers using this library must update immediately to prevent unauthorized access. Ignoring this could lead to severe security breaches.

Arctic Wolf Blog·Yesterday, 8:34 PM
CRITICALVulnerabilities

Critical Authentication Bypass in pac4j-jwt Library Exposed!

A severe flaw in the pac4j-jwt library allows hackers to bypass authentication. This affects applications relying on the library, risking user data and security. Immediate updates are essential to protect against exploitation.

Arctic Wolf Blog·Yesterday, 7:55 PM
HIGHVulnerabilities

Firefox Faces 22 Vulnerabilities Discovered by Anthropic

Anthropic discovered 22 vulnerabilities in Firefox, with 14 marked high-severity. This puts users at risk of data breaches and unauthorized access. Mozilla is working on patches to fix these issues.

TechCrunch Security·Yesterday, 7:00 PM
CRITICALVulnerabilities

Cisco FMC Faces Maximum-Severity Vulnerabilities: Act Now!

Cisco has identified two critical vulnerabilities in its Secure Firewall Management Center software. Organizations using this software are at risk of unauthorized access and control. Immediate patching is essential to protect sensitive data and maintain security.

Arctic Wolf Blog·Yesterday, 5:58 PM
HIGHVulnerabilities

Firefox Vulnerabilities Exposed by AI in Just Two Weeks

AI has uncovered 22 vulnerabilities in Firefox in just two weeks. This affects anyone using the browser, putting personal data at risk. Mozilla is working on patches to fix these issues, so stay updated!

Cyber Security News·Yesterday, 5:38 PM
HIGHVulnerabilities

Linux Rootkits Evolve with eBPF and io_uring Threats

Linux rootkits are evolving into a serious threat, targeting cloud and IoT systems. This shift puts many users at risk of data breaches and disruptions. Experts are working on detection methods and patches to combat these threats.

Cyber Security News·Yesterday, 5:33 PM