Anthropic's CVD ledger identifies two Opus 4.6 findings

Two qualifying Project Glasswing cards explicitly name Claude Opus 4.6 on PostgreSQL and rabbitmq-c vulnerabilities.

Bug class: Authentication downgrade and memory-safety vulnerabilities
Affected codebase: PostgreSQL and rabbitmq-c
Credited system: Claude Opus 4.6
Latest disclosure: July 21, 2026
Coverage: Project Glasswing cards revealed July 20-21, 2026; checked September 16, 2026
Attribution: Direct source attribution
AI role: Discovery
Severity: high

Source status: Anthropic's individual cards ANT-2026-CJQWKW82 and ANT-2026-D7FC4YDQ explicitly name Claude Opus 4.6 and show fixed, patched, vendor-confirmed records with CVE and GHSA mappings.

Summary

The PostgreSQL card maps CVE-2026-6479 to Claude Opus 4.6, while the rabbitmq-c card maps CVE-2026-44236 to the same model. Both rows pass the public, fixed, patched, vendor-confirmed filter and are high severity in Anthropic’s vendor-first severity fallback.

CVE-2026-44236 had not reached the public CVE JSON corpus by September 16, but the public Anthropic card maps it to GHSA-jh48-qjf5-fx5v and records the fixed upstream state. This page separates the two exact Opus credits from the wider Project Glasswing campaign.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.