CVE-2026-34450 in Anthropic anthropic-sdk-python

요약 (영어)

The Claude SDK for Python provides access to the Claude API from Python applications. From version 0.86.0 to before version 0.87.0, the local filesystem memory tool in the Anthropic Python SDK created memory files with mode 0o666, leaving them world-readable on systems with a standard umask and world-writable in environments with a permissive umask such as many Docker base images. A local attacker on a shared host could read persisted agent state, and in containerized deployments could modify memory files to influence subsequent model behavior. Both the synchronous and asynchronous memory tool implementations were affected. This issue has been patched in version 0.87.0.

책임이 있는

GitHub_M

예약하다

2026. 03. 27.

공개

2026. 04. 01.

엔트리

VulDB provides additional information and datapoints for this CVE:

아이디	취약성	CWE	악용	대책	CVE
354557	Anthropic anthropic-sdk-python Claude API 권한 상승	276	정의되지 않음	공식 수정	CVE-2026-34450