Claude Code selected an API key stored by Claude Code
Low2.0CVE-2026-103012 · Published Sep 30, 2026
Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated with the Enterprise or Team account. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy (such as permission deny rules, model restrictions and managed-only locks) or, if a previously cached copy existed on the machine, kept applying that stale copy without receiving later policy changes — while continuing to operate as the organization's account. Triggering this required local access to a device with such a stored API key; the no-policy case additionally required that no managed settings had previously been cached. Endpoint-managed (MDM or file-based) settings were not affected. Claude for Enterprise organizations were affected from version 2.0.68; Claude for Work (Team) organizations from version 2.1.38, when server-managed settings became available to them. Users on standard Claude Code auto-update have received this ...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| @anthropic-ai/claude-code Product | >= 2.0.68, < 2.1.260 | 2.1.260 |
Details and references
Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated with the Enterprise or Team account. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy (such as permission deny rules, model restrictions and managed-only locks) or, if a previously cached copy existed on the machine, kept applying that stale copy without receiving later policy changes — while continuing to operate as the organization's account. Triggering this required local access to a device with such a stored API key; the no-policy case additionally required that no managed settings had previously been cached. Endpoint-managed (MDM or file-based) settings were not affected. Claude for Enterprise organizations were affected from version 2.0.68; Claude for Work (Team) organizations from version 2.1.38, when server-managed settings became available to them. Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.1.260 or later. Thank you to Tamas Voros / NVIDIA AI Red Team for reporting this issue.
- CVSS 4.0
- CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-696
More Anthropic advisories
All Anthropic| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 25 | Claude Desktop (macOS): opening a malicious file from a Cowork folder could run commands on the host | High8.5 | 1.15962.0 |
| Sep 12 | Argument Injection via resume Option Allows Arbitrary Command Execution | Critical9.2 | 0.2.121 |
| Jul 1 | Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation | Medium6.3 | 0.8.0+1 more |
| Jul 1 | Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref | Medium5.9 | 0.7.0 |
| Jun 25 | Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write | Medium4.4 | 2.1.128 |
| Jun 25 | Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution | High7.7 | 2.1.163 |