CVE-2026-103012 in claude-code
Summary
by MITRE • 09/30/2026
Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated with the Enterprise or Team account. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy (such as permission deny rules, model restrictions and managed-only locks) or, if a previously cached copy existed on the machine, kept applying that stale copy without receiving later policy changes — while continuing to operate as the organization's account. Triggering this required local access to a device with such a stored API key; the no-policy case additionally required that no managed settings had previously been cached. Endpoint-managed (MDM or file-based) settings were not affected. Claude for Enterprise organizations were affected from version 2.0.68; Claude for Work (Team) organizations from version 2.1.38, when server-managed settings became available to them.
Users on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.1.260 or later.
Thank you to Tamas Voros / NVIDIA AI Red Team for reporting this issue.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/30/2026
The vulnerability described involves a critical authentication and authorization flaw within the Claude Code application, specifically affecting versions of Claude for Enterprise starting from 2.0.68 and Claude for Work (Team) organizations from version 2.1.38. This security defect arises during the initialization phase when the client attempts to fetch organization-specific server-managed settings. The core technical flaw lies in the prioritization logic used by the application to select an API key for this request. Instead of utilizing the credentials associated with the currently active session, which has been properly authenticated against the Enterprise or Team account, the software incorrectly selects a previously stored API key. This stale credential may have been saved during an earlier login event or written directly into the local configuration files by previous operations. Consequently, when the application attempts to retrieve policy configurations such as permission deny rules, model restrictions, and managed-only locks from the server, it presents this outdated or unauthorized key rather than the valid session token.
The operational impact of this vulnerability is significant because it results in a bypass of organization-mandated security policies. When the endpoint rejects the stale API key due to invalidity or lack of permissions for that specific organizational context, the application fails to receive the necessary policy definitions from the server. In scenarios where no managed settings have been previously cached on the local machine, this leads to a complete absence of enforcement mechanisms. The user continues to operate under their organization account identity but without any of the restrictive policies designed by administrators, such as restrictions on specific AI models or data handling rules. Alternatively, if a previous version of these settings was successfully fetched and cached locally before the policy changes occurred, the application may continue to apply this stale configuration. This creates a persistent state where security controls are outdated or entirely missing, effectively nullifying the administrative intent behind server-managed policies while maintaining the appearance of being logged into the correct organizational account.
This vulnerability requires local access to a device that has previously stored an API key within the Claude Code environment. The severity is compounded by the fact that it affects users who have authenticated via standard Enterprise or Team sign-in processes, creating a false sense of security regarding their compliance posture. It does not affect endpoint-managed settings controlled through Mobile Device Management (MDM) or file-based configurations, which remain isolated from this specific client-side logic error. The flaw represents a classic case of improper credential handling and session state management, where the application fails to maintain strict separation between stored credentials for configuration retrieval and active session tokens for user interaction. This misalignment allows an attacker with local access to potentially exploit the environment by leveraging stale keys or bypassing policy enforcement entirely, depending on the caching status of the device.
From a classification perspective, this issue aligns with CWE-287: Improper Authentication, as the system fails to correctly authenticate the client during the retrieval of critical security policies. It also relates to CWE-613: Insufficient Session Expiration, given that stale credentials are used beyond their valid context or validity period for organizational settings. In terms of the MITRE ATT&CK framework, this vulnerability facilitates Initial Access and Defense Evasion tactics by allowing an actor with local access to bypass security controls (T1562) and potentially escalate privileges within the application's logical boundaries by operating without restrictive policies (T1078). The lack of proper validation between the session identity and the credential used for configuration fetches creates a gap that undermines the integrity of the organizational security model.
Mitigation strategies focus primarily on software updates, as this is a defect in the client-side application logic rather than a server-side misconfiguration. Users running standard auto-update mechanisms have likely already received the patch which corrects the API key selection priority to ensure the active session token is used for fetching organization settings. For those performing manual updates or operating in environments with delayed update cycles, it is imperative to upgrade immediately to version 2.1.260 or later. This updated version resolves the logic error that prioritizes stored keys over current session credentials. Additionally, organizations should enforce strict device management policies and ensure that all endpoints are regularly scanned for outdated software versions. Regular audits of local configuration files can help identify any residual stale API keys that might pose a risk if updates are delayed further. The vulnerability was responsibly disclosed by Tamas Voros from the NVIDIA AI Red Team, highlighting the importance of external security testing in identifying subtle logic flaws in complex client-server interactions.