CVE-2026-12537, CVE-2026-54316: Anthropic, Google, OpenAI CI Runners — Remote Code Execution Risk (August 2026)

CVE-2026-12537, CVE-2026-54316 — Anthropic, Google, OpenAI CI Runners

Two critical flaws, CVE-2026-12537 and CVE-2026-54316 (CVSS up to 10.0), allowed unprivileged GitHub users to execute arbitrary code and exfiltrate secrets from CI runners used by Anthropic, Google, and OpenAI. No exploitation in the wild has been confirmed, but the vulnerabilities were demonstrated at Black Hat USA 2026 and patched shortly after disclosure.

Attack Vector

Attackers could submit maliciously crafted inputs—such as pull requests or issues—to repositories using Claude Code or Gemini CLI integrations. These inputs triggered OS command injection within the CI pipeline, enabling code execution on the underlying CI host before sandboxing protections activated. In some cases, attackers could hijack CI runs and access sensitive environment variables, including API keys, by exploiting insufficient input sanitization. The attack required only unprivileged GitHub access to the target repositories.

Who Is at Risk

Repositories using Claude Code or Gemini CLI in their CI/CD pipelines are directly affected. Confirmed impacted organizations include Anthropic, Google (coding-agent repositories), and OpenAI. All public and private repositories integrating these tools prior to the August 2026 patch are at risk, regardless of deployment region.

Patch & Mitigate

• Patch: Apply the security updates released in August 2026 for Claude Code and Gemini CLI immediately. Confirm your CI runners are not using vulnerable versions.
• Workaround: Temporarily disable automated CI triggers for untrusted GitHub events (e.g., pull requests from external contributors) until patched.
• Detect: Review CI/CD logs for unusual command execution, unexpected environment variable access, or anomalous API key usage. Monitor for suspicious PRs/issues with embedded shell commands.

MITRE ATT&CK

• TA0001 — Initial Access: Attackers leverage GitHub user input to gain a foothold in CI environments.
• TA0005 — Defense Evasion: Exploitation occurs before CI sandboxing, bypassing standard isolation controls.

Source: https://thehackernews.com/2026/08/claude-code-and-gemini-cli-flaws-let.html