CVE-2026-81836: Roo-Code cleartext OAuth callback

CISO Take

Roo-Code, an abandoned VS Code AI coding-agent extension, transmits sensitive data in cleartext during its OAuth callback flow for Claude Code integration, exposing authorization tokens to anyone positioned on the network path between the client and callback endpoint. The practical risk to most organizations is low: exploitation requires high attack complexity and precise network positioning (CVSS 3.7, AV:N/AC:H, confidentiality-only impact), there is no evidence of active exploitation and it is not in CISA KEV, though a public proof-of-concept exploit already exists on GitHub. What makes this notable isn't the flaw itself but the vendor response — RooCodeInc has confirmed the repository is archived and unsupported, so this and any future findings in Roo-Code will never be patched. The only real action is inventory and retirement: search your developer fleet for the Roo-Code VS Code extension, uninstall it, rotate any OAuth tokens or API credentials ever used through it, and redirect developers to an actively maintained alternative (e.g., Cline, Kilo Code, or the official Claude Code extension).

Sources: VulDB GitHub ATLAS

What is the risk?

Overall risk is LOW. The CVSS score (3.7) reflects a confidentiality-only impact with no effect on integrity or availability, and CVSS AC:H combined with the vendor's own note that 'exploitability is difficult' means opportunistic mass exploitation is unlikely — this requires an attacker to intercept network traffic during an active OAuth callback, i.e., a MITM-style positioning attack. There is no EPSS data, no CISA KEV listing, and no SSVC decision recorded, consistent with a low-priority, narrow-blast-radius issue. The one aggravating factor is permanence: because the project is archived and the vendor explicitly disclaims support, this vulnerability is effectively unpatchable and will persist indefinitely in any environment that still has Roo-Code installed.

How does the attack unfold?

Network positioning

Attacker gains a man-in-the-middle position on the network path between the victim's Roo-Code extension and the OAuth callback endpoint (e.g., shared Wi-Fi, compromised router).

Traffic interception

Victim initiates OAuth login in Roo-Code; the callback data is transmitted in cleartext and captured by the attacker.

AML.T0091.000

Credential theft

Attacker extracts the authorization code or token from the intercepted cleartext traffic.

AML.T0055

Impact: account impersonation

Attacker replays the stolen token to authenticate as the victim against the connected Claude Code account, gaining unauthorized access to the victim's AI service session.

AML.T0012

Network positioning

Attacker gains a man-in-the-middle position on the network path between the victim's Roo-Code extension and the OAuth callback endpoint (e.g., shared Wi-Fi, compromised router).

Traffic interception

Victim initiates OAuth login in Roo-Code; the callback data is transmitted in cleartext and captured by the attacker.

AML.T0091.000

Credential theft

Attacker extracts the authorization code or token from the intercepted cleartext traffic.

AML.T0055

Impact: account impersonation

Attacker replays the stolen token to authenticate as the victim against the connected Claude Code account, gaining unauthorized access to the victim's AI service session.

AML.T0012

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Roo-Code	—	—	No patch

Do you use Roo-Code? You're affected.

How severe is it?

CVSS 3.1

3.7 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C Low

I None

A None

What should I do?

1 step

No vendor patch will be released — the repository is archived. Recommended actions: (1) inventory developer workstations for the Roo-Code VS Code extension and uninstall it; (2) rotate any OAuth tokens, API keys, or session credentials that were ever used through Roo-Code's Claude Code integration; (3) migrate affected developers to an actively maintained alternative such as Cline, Kilo Code, or the official Claude Code CLI/extension; (4) as a network-level compensating control, enforce TLS interception/inspection or block plaintext HTTP egress from developer endpoints where feasible; (5) monitor for anomalous use of Claude Code API credentials that could indicate token replay from an intercepted OAuth callback.

How is it classified?

Data Leakage Auth Bypass Agent Plugin API AML.T0012 - Valid Accounts AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, Robustness and Cybersecurity

OWASP LLM Top 10

LLM02 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-81836?

Roo-Code, an abandoned VS Code AI coding-agent extension, transmits sensitive data in cleartext during its OAuth callback flow for Claude Code integration, exposing authorization tokens to anyone positioned on the network path between the client and callback endpoint. The practical risk to most organizations is low: exploitation requires high attack complexity and precise network positioning (CVSS 3.7, AV:N/AC:H, confidentiality-only impact), there is no evidence of active exploitation and it is not in CISA KEV, though a public proof-of-concept exploit already exists on GitHub. What makes this notable isn't the flaw itself but the vendor response — RooCodeInc has confirmed the repository is archived and unsupported, so this and any future findings in Roo-Code will never be patched. The only real action is inventory and retirement: search your developer fleet for the Roo-Code VS Code extension, uninstall it, rotate any OAuth tokens or API credentials ever used through it, and redirect developers to an actively maintained alternative (e.g., Cline, Kilo Code, or the official Claude Code extension).

Is CVE-2026-81836 actively exploited?

No confirmed active exploitation of CVE-2026-81836 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-81836?

No vendor patch will be released — the repository is archived. Recommended actions: (1) inventory developer workstations for the Roo-Code VS Code extension and uninstall it; (2) rotate any OAuth tokens, API keys, or session credentials that were ever used through Roo-Code's Claude Code integration; (3) migrate affected developers to an actively maintained alternative such as Cline, Kilo Code, or the official Claude Code CLI/extension; (4) as a network-level compensating control, enforce TLS interception/inspection or block plaintext HTTP egress from developer endpoints where feasible; (5) monitor for anomalous use of Claude Code API credentials that could indicate token replay from an intercepted OAuth callback.

What systems are affected by CVE-2026-81836?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, IDE-integrated AI coding agents, OAuth-based authentication flows.

What is the CVSS score for CVE-2026-81836?

CVE-2026-81836 has a CVSS v3.1 base score of 3.7 (LOW).

What is the AI security impact?

Affected AI Architectures

agent frameworksIDE-integrated AI coding agentsOAuth-based authentication flows

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

A vulnerability was detected in RooCodeInc Roo-Code up to 3.51.1. This vulnerability affects unknown code of the file src/integrations/claude-code/oauth.ts of the component OAuth Callback. The manipulation results in cleartext transmission of sensitive information. The attack may be performed from remote. A high complexity level is associated with this attack. It is stated that the exploitability is difficult. The exploit is now public and may be used. Multiple isses were reported to the vendor beforehand. They explain, that "they all apply to Roo Code, a project we no longer support - the repository was archived a while ago, and we don't encourage anyone to use it." This vulnerability only affects products that are no longer supported by the maintainer.

Exploitation Scenario

A developer using Roo-Code on a shared or untrusted network (public Wi-Fi, a compromised router, or a network with an on-path attacker) initiates the OAuth login flow to connect Roo-Code to their Claude Code account. Because the OAuth callback transmits data in cleartext, an attacker positioned on that network path intercepts the callback and captures the authorization code or token. The attacker then replays or reuses that credential to authenticate as the victim against the Claude Code backend, gaining unauthorized access to the developer's connected AI account and any resources reachable through it. The high attack complexity (AC:H) means this is a targeted, opportunistic-network attack rather than something exploitable at scale over the internet.

Weaknesses (CWE)

CWE-310 CWE-319 Cleartext Transmission of Sensitive Information

CWE-319 — Cleartext Transmission of Sensitive Information: The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

[Architecture and Design] Before transmitting, encrypt the data using reliable, confidentiality-protecting cryptographic protocols.
[Implementation] When using web applications with SSL, use SSL for the entire session from login to logout, not just for the initial login page.

Source: MITRE CWE corpus.