CVE-2026-81836: Roo-Code Information Disclosure Vulnerability

CVE-2026-81836 Overview

CVE-2026-81836 is a cleartext transmission of sensitive information vulnerability in RooCodeInc Roo-Code versions up to 3.51.1. The flaw resides in the OAuth Callback component, specifically in src/integrations/claude-code/oauth.ts. An attacker with network position can potentially intercept sensitive OAuth data transmitted without encryption. The vendor has archived the Roo-Code repository and does not support the project, meaning no official patch will be issued. A public exploit exists, though exploitation requires high complexity conditions. This vulnerability is categorized under CWE-310 for cryptographic issues.

Critical Impact
Sensitive OAuth data handled by the Claude Code integration may be transmitted in cleartext, exposing tokens or credentials to network-level interception. The affected project is unsupported by the maintainer.

Affected Products

RooCodeInc Roo-Code up to and including version 3.51.1
Roo-Code Claude Code OAuth integration (src/integrations/claude-code/oauth.ts)
Any downstream deployments still running the archived Roo-Code repository

Discovery Timeline

2026-08-28 - CVE-2026-81836 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-81836

Vulnerability Analysis

The vulnerability exists in the OAuth callback handler used by Roo-Code's Claude Code integration. The implementation in oauth.ts transmits sensitive authentication data across the network without applying cryptographic protection. An attacker positioned to observe network traffic between the client and OAuth endpoints can capture the exposed material. The scope is limited to confidentiality of the transmitted values; the flaw does not directly grant code execution or state modification. Because the maintainer archived Roo-Code and explicitly states the project should not be used, no coordinated fix is planned for this or the other reported issues.

Root Cause

The root cause is improper protection of sensitive data in transit within the OAuth callback flow. The src/integrations/claude-code/oauth.ts handler processes OAuth exchange values without enforcing encrypted transport or equivalent safeguards on the callback channel. This aligns with CWE-310, Cryptographic Issues, where an application fails to apply required cryptographic controls to protect confidentiality.

Attack Vector

Exploitation is remote but constrained by high attack complexity. An attacker must be positioned to observe or intercept OAuth callback traffic, for example on a shared network segment, a compromised intermediate hop, or through DNS or routing manipulation. Once positioned, the attacker captures cleartext OAuth material from the callback. Public exploit material has been referenced on a GitHub Gist. Additional analysis is available in the VulDB entry for CVE-2026-81836 and the VulDB vulnerability record #396169.

No verified proof-of-concept code is reproduced here. Refer to the linked references for exploit details.

Detection Methods for CVE-2026-81836

Indicators of Compromise

Plaintext OAuth tokens, authorization codes, or session identifiers observed in captured HTTP traffic to or from Roo-Code hosts
OAuth callback requests to endpoints handled by src/integrations/claude-code/oauth.ts traversing non-TLS channels
Unexpected reuse of Claude Code OAuth tokens from IP addresses not associated with the legitimate user

Detection Strategies

Inspect network flows involving Roo-Code deployments for OAuth callback traffic sent over http:// rather than https://
Correlate OAuth token usage against expected client fingerprints and geolocations to detect replay of intercepted credentials
Review application logs for OAuth callback handling events tied to the Claude Code integration path

Monitoring Recommendations

Alert on any process invoking Roo-Code binaries or the archived repository on managed endpoints
Monitor egress to OAuth provider endpoints from developer workstations for unencrypted transports
Track authentication anomalies on Claude Code accounts linked to Roo-Code integrations, including token issuance from unusual sources

How to Mitigate CVE-2026-81836

Immediate Actions Required

Discontinue use of RooCodeInc Roo-Code, as the vendor has archived the project and states it should not be used
Revoke and rotate any OAuth tokens, refresh tokens, or credentials previously exchanged through the Roo-Code Claude Code integration
Remove Roo-Code installations from developer workstations and CI systems until a supported alternative is selected

Patch Information

No patch is available. The maintainer has archived the Roo-Code repository and has publicly stated the project is no longer supported. Users must migrate to a maintained alternative rather than expect a fix. Reference details are tracked in the VulDB CVE-2026-81836 entry and the VulDB submission #864287.

Workarounds

Migrate to a supported OAuth-enabled client for Claude Code integrations instead of continuing with the archived Roo-Code
If temporary continued use is unavoidable, tunnel OAuth callback traffic through a TLS-terminating reverse proxy that enforces HTTPS end to end
Restrict Roo-Code hosts to trusted network segments and block outbound cleartext HTTP to OAuth endpoints at the firewall

bash

# Example: block cleartext HTTP egress to OAuth endpoints on Linux hosts
sudo iptables -A OUTPUT -p tcp --dport 80 -m string \
  --string "oauth" --algo bm -j REJECT