CVE-2026-96620

Claude Python SDK resume input can inject startup options

Anthropic · Claude Agent SDK for Python

First documented disclosure · Review checkpoint

Summary

Applications passing an untrusted session identifier to resume could start an unauthorized MCP process.

Severity and exploitation evidence

Critical · 9.2/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources do not establish malicious exploitation. A published proof of concept is not evidence of a customer compromise.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

A dash-leading resume value was parsed as a separate CLI option.

Conditions required

The application accepts attacker-controlled resume input and forwards it into the SDK.

Potential impact

Command execution at CLI startup outside SDK tool-permission controls.

Affected versions and configurations

Before 0.2.121.

Fix and mitigation status

0.2.121.

Practical next steps

Upgrade and validate externally supplied session identifiers; review all process-startup arguments.

Operating lesson

Agent tool permissions must also cover startup and configuration boundaries.

Evidence and limits

The July 15 public fix discussion assessed narrower flag injection; the September 12 advisory describes the MCP command-execution consequence. October 16 is CVE publication.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources