CVE-2026-46406: Claude Code predictable temp file

CISO Take

Claude Code's /copy command wrote AI response output to a hardcoded, world-readable path (/tmp/claude/response.md) with no per-user isolation or symlink protection, so any unprivileged local user on a shared system could read a privileged colleague's Claude output — potentially exposing secrets or credentials pasted into a session — or pre-plant a symlink to have Claude Code overwrite an arbitrary file the privileged user can write to. This is a classic CWE-59/CWE-377 local temp-file race rather than a novel AI attack technique, but it ships in a widely used AI coding agent, and while EPSS's raw score is low (0.00149), its relative percentile sits in the top 96%, and 0 downstream dependents are tracked, so realistic exploitation is limited to shared or multi-tenant systems. It is not in CISA KEV and no public exploit or Nuclei template exists yet. Anthropic has already shipped the fix in 2.1.128 to auto-updating users; teams on manual updates should patch immediately, especially on shared dev boxes, CI runners, or jump hosts.

Sources: NVD GitHub Advisory EPSS CISA KEV ATLAS

What is the risk?

Medium severity per Anthropic's own rating, driven by the local-only attack vector (CWE-59, CWE-200, CWE-377) rather than remote exploitability — both required conditions (an unprivileged local attacker plus a privileged user actively running /copy) narrow the realistic blast radius to shared or multi-tenant systems such as CI/CD runners, shared dev boxes, jump hosts, or multi-UID containers. EPSS's absolute score (0.00149) is low despite a high relative percentile, the CVE is not in CISA KEV, and no public PoC or scanner signature exists, so near-term mass exploitation is unlikely. The meaningful risk is targeted privilege escalation: an insider or an attacker who has already gained a low-privilege foothold can use this to read secrets from a privileged AI session or overwrite a file the privileged user can write — a real primitive in CI and shared-host contexts even though it's rated medium in isolation.

How does the attack unfold?

Local Foothold

Attacker obtains an unprivileged local account on a shared multi-user system (CI runner, shared dev box, or jump host) where a privileged user also runs Claude Code.

Pre-plant Symlink or Wait

Attacker pre-creates /tmp/claude/ and plants a symlink at response.md pointing to a target file, or simply prepares to read the predictable path once written.

AML.T0037

Privileged /copy Execution

The privileged user runs Claude Code's /copy command, which writes the AI response to the predictable, world-readable path — following the attacker's symlink if planted.

AML.T0055

Impact: Disclosure or Overwrite

Attacker reads exposed secrets/credentials from the response file, or the privileged process overwrites an attacker-chosen file, enabling data leakage or potential privilege escalation.

AML.T0112.000

Local Foothold

Attacker obtains an unprivileged local account on a shared multi-user system (CI runner, shared dev box, or jump host) where a privileged user also runs Claude Code.

Pre-plant Symlink or Wait

Attacker pre-creates /tmp/claude/ and plants a symlink at response.md pointing to a target file, or simply prepares to read the predictable path once written.

AML.T0037

Privileged /copy Execution

The privileged user runs Claude Code's /copy command, which writes the AI response to the predictable, world-readable path — following the attacker's symlink if planted.

AML.T0055

Impact: Disclosure or Overwrite

Attacker reads exposed secrets/credentials from the response file, or the privileged process overwrites an attacker-chosen file, enabling data leakage or potential privilege escalation.

AML.T0112.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Claude Code	npm	>= 2.1.59, < 2.1.128	`2.1.128`
140.7K Pushed 3d ago 69% patched ~5d to patch Full package profile →
Claude Code	npm	—	No patch
140.7K Pushed 3d ago 69% patched ~5d to patch Full package profile →

How severe is it?

CVSS 3.1

N/A

EPSS

0.1%

chance of exploitation in 30 days

Higher than 2% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Patch immediately: upgrade @anthropic-ai/claude-code to >= 2.1.128 (the fixed version); users on Claude Code's default auto-update channel have already received the fix. For manual-update installs, verify the running version with claude --version and update via your package manager. As a compensating control on systems that can't patch immediately, avoid running /copy as a privileged user on hosts with other local logins, or enforce per-user /tmp isolation (e.g., systemd PrivateTmp=yes) so /tmp/claude/ isn't shared across UIDs. For detection, audit for pre-existing symlinks or directories at /tmp/claude/response.md prior to a privileged Claude Code session, and monitor /tmp for unexpected 0644 world-readable AI-response artifacts. Treat any secrets that may have transited /copy on unpatched, shared systems as potentially exposed and rotate them.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Code Execution Privacy Violation Agent AML.T0037 - Data from Local System AML.T0055 - Unsecured Credentials AML.T0112.000 - Local AI Agent

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated and documented

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-46406?

Claude Code's /copy command wrote AI response output to a hardcoded, world-readable path (/tmp/claude/response.md) with no per-user isolation or symlink protection, so any unprivileged local user on a shared system could read a privileged colleague's Claude output — potentially exposing secrets or credentials pasted into a session — or pre-plant a symlink to have Claude Code overwrite an arbitrary file the privileged user can write to. This is a classic CWE-59/CWE-377 local temp-file race rather than a novel AI attack technique, but it ships in a widely used AI coding agent, and while EPSS's raw score is low (0.00149), its relative percentile sits in the top 96%, and 0 downstream dependents are tracked, so realistic exploitation is limited to shared or multi-tenant systems. It is not in CISA KEV and no public exploit or Nuclei template exists yet. Anthropic has already shipped the fix in 2.1.128 to auto-updating users; teams on manual updates should patch immediately, especially on shared dev boxes, CI runners, or jump hosts.

Is CVE-2026-46406 actively exploited?

No confirmed active exploitation of CVE-2026-46406 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-46406?

Patch immediately: upgrade @anthropic-ai/claude-code to >= 2.1.128 (the fixed version); users on Claude Code's default auto-update channel have already received the fix. For manual-update installs, verify the running version with `claude --version` and update via your package manager. As a compensating control on systems that can't patch immediately, avoid running /copy as a privileged user on hosts with other local logins, or enforce per-user /tmp isolation (e.g., systemd PrivateTmp=yes) so /tmp/claude/ isn't shared across UIDs. For detection, audit for pre-existing symlinks or directories at /tmp/claude/response.md prior to a privileged Claude Code session, and monitor /tmp for unexpected 0644 world-readable AI-response artifacts. Treat any secrets that may have transited /copy on unpatched, shared systems as potentially exposed and rotate them.

What systems are affected by CVE-2026-46406?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

What is the CVSS score for CVE-2026-46406?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworks

MITRE ATLAS Techniques

AML.T0037 Data from Local System

AML.T0055 Unsecured Credentials

AML.T0112.000 Local AI Agent

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

The Claude Code `/copy` command wrote responses to a hardcoded, predictable path (`/tmp/claude/response.md`) without UID isolation, randomness, or symlink protection. The file was created world-readable (0644) in a world-traversable directory (0755), allowing any local user to read a privileged user's Claude response, which could contain secrets or credentials. Additionally, because the path was static and predictable, a local attacker could pre-create the directory and plant a symlink at the expected file path, causing the privileged process to follow the symlink and overwrite an attacker-chosen file with the response text. Exploiting this required a local unprivileged user on the same system and a privileged user to run the `/copy` command. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to the latest version. Claude Code thanks hackerone.com/c_h4ck_0 for reporting this issue.

Exploitation Scenario

On a shared CI runner or multi-user dev VM, a low-privilege attacker pre-creates /tmp/claude/ and plants a symlink at response.md pointing to a file they want overwritten — say, the privileged user's ~/.bashrc, an SSH authorized_keys file, or a deployment script the privileged CI service account can write. When the privileged user or an automated pipeline later runs Claude Code's /copy command, Claude Code writes its response through the symlink, silently corrupting or overwriting the attacker's chosen target with AI-generated text — potentially disabling a security control or injecting unintended content into a script. In the simpler information-disclosure variant, the attacker just polls /tmp/claude/response.md for content and reads any secrets or proprietary code the privileged user pasted into their Claude session before the file is next overwritten.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-377 Insecure Temporary File Primary CWE-59 Improper Link Resolution Before File Access ('Link Following') Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-377 Insecure Temporary File CWE-59 Improper Link Resolution Before File Access ('Link Following')

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.