AIKIDO-2026-451947
anthropic is vulnerable to Exposure of Sensitive Information
53
Medium Risk
This Affects:
anthropicTL;DR
The credential providers in the anthropic SDK held API keys, tokens, and other credential material as plain strings while reading, parsing, and refreshing credentials for workload identity federation, OAuth, and auth profiles. When an exception was raised in those code paths, the secret values remained in the traceback frame locals, so any traceback capture such as error logging or crash/error-reporting integrations could persist them outside the process. The fix wraps secret fields in a SecretStr type and strips secret material from traceback frames so credentials are redacted in error output. This prevents inadvertent disclosure of sensitive credential data through tracebacks.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
anthropic is vulnerable to Exposure of Sensitive Information in versions 0.98.0 - 0.116.0.
How to fix this
Upgrade the anthropic library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant