feat: AVE-2026-00073 -- telemetry/endpoint redirect via static configuration - #131
Merged
chaksaray merged 2 commits intoAug 6, 2026
Merged
Conversation
…uration Credit predictor2718's detailed cfgaudit gap breakdown on issue #68, resolving the AVE-2026-00002 distinction question directly: three rules (CFG046 OTEL exporter, CFG005 ANTHROPIC_BASE_URL, CFG071 cleartext model/provider URL) share one mechanism -- a committed key/value changes where the process sends data, no content injected into the model's context in any of them. Drafted as one record per predictor2718's own framing, three manifestations of the same mechanism, not three separate records. CFG005's exact mechanism is CVE-2026-21852 (GHSA-jh7p-qr78-84p7): a malicious repository's committed settings redirected Claude Code's API traffic and leaked the user's API key before any trust confirmation was shown, CVSS 5.3, fixed in v2.0.65. mitre_atlas left as a researched empty array: ATLAS's own exfiltration techniques (AML.T0024, AML.T0025, AML.T0056) target different mechanisms; none address destination-endpoint redirection via configuration, a confirmed gap, not a shortfall. owasp_asi intentionally omitted, same discipline as AVE-2026-00061/00072.
…3-telemetry-endpoint-redirect # Conflicts: # CHANGELOG.md # README.md # dist/ave-records-latest.json # dist/ave-records-latest.manifest.json
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AVE-2026-00073: telemetry or API endpoint redirect via static configuration (MEDIUM, AIVSS 4.1). Third and final record drafted from predictor2718's detailed mechanism breakdown on issue #68 for this pass.
One mechanism, three manifestations -- and the AVE-2026-00002 distinction
predictor2718's breakdown resolved an open question from the issue directly: does this need to be distinguished from AVE-2026-00002 (MCP tool description behavioral injection)? Yes, and cleanly -- detection here is reading a config value and comparing a host, not analyzing content for instructions. No prompt text, no skill body, no tool description is ever involved. Per his own framing, three concrete rules share this one mechanism, drafted as one record, not three:
OTEL_EXPORTER_OTLP_ENDPOINTand per-signal variants pointing at a non-local collector (CFG046)ANTHROPIC_BASE_URLpointing away from Anthropic -- the exact mechanism behind CVE-2026-21852 (CFG005)http://, API key sent in plaintext (CFG071)CVE-2026-21852, verified
A malicious repository's committed settings file set
ANTHROPIC_BASE_URLto an attacker-controlled endpoint. Because Claude Code honored it before showing any trust confirmation, every subsequent API request -- including the one carrying the user's own API key -- was redirected. CVSS 5.3, fixed in v2.0.65.Framework mappings, researched not assumed
owasp_mcp: ["MCP01"](Token Mismanagement & Secret Exposure) verified against OWASP's own published category list.mitre_atlas: []: researched. ATLAS's own exfiltration techniques (AML.T0024 AI Inference API, AML.T0025 Cyber Means, AML.T0056 System Prompt Extraction) all target different mechanisms; none address destination-endpoint redirection via configuration -- a genuine, confirmed gap.owasp_asiintentionally omitted, same discipline already applied to AVE-2026-00061 and AVE-2026-00072.CWE-200(Exposure of Sensitive Information to an Unauthorized Actor) confirmed as the fitting umbrella CWE across all three manifestations.AIVSS notes
mitigation_factordiscounted to 0.83: a straightforward allowlist-and-refuse mitigation exists and closes the class cleanly.thm=0.90rather than 1.0: only one of the three manifestations (CFG005) carries a disclosed CVE individually; treating the whole record as fully in-the-wild would overstate the other two.Validation
python3 scripts/validate_records.py: all 71 records valid.python3 scripts/check_fixtures.py: all 71 records have positive + negative fixtures.pytest tests/ -x -q: 284 passed.python3 scripts/validate_crosswalks.py: 4/4 crosswalks valid.node scripts/build-records.js: dist regenerated; frozen v1.1.0 snapshot untouched.Scope notes
No detection-rule PR in bawbel/scanner -- separate tracker. This completes the three records planned for this pass. Sandbox-config weakening remains explicitly held per predictor2718's own two flagged reasons (CFG064's field list still moving; a documented hardening-vs-weakening trap in the field names) -- not part of this pass, will follow up on issue #68 once shipped.