{"id":"CVE-2026-103012","kind":"vulnerability","aliases":["CVE-2026-103012","GHSA-gfvf-j8jh-jxxw"],"related":[],"title":"Managed Settings Not Applied When a Stored API Key Was Preferred Over Enterprise Sign-In","description":"Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even though the session itself authenticated with the Enterprise or Team account. When the settings endpoint rejected that stored key, the session started without the organization's server-managed policy (such as permission deny rules, model restrictions and managed-only locks) or, if a previously cached copy existed on the machine, kept applying that stale copy without receiving later policy changes — while continuing to operate as the organization's account. Triggering this required local access to a device with such a stored API key; the no-policy case additionally required that no managed settings had previously been cached. Endpoint-managed (MDM or file-based) settings were not affected. Claude for Enterprise organizations were affected from version 2.0.68; Claude for Work (Team) organizations from version 2.1.38, when server-managed settings became available to them.\n\nUsers on standard Claude Code auto-update have received this fix already. Users performing manual updates are advised to update to version 2.1.260 or later.\n\nThank you to Tamas Voros / NVIDIA AI Red Team for reporting this issue.","summary":"Claude Code could pick a stored API key over a valid Enterprise or Team sign-in when fetching organization server-managed settings. When the settings endpoint rejected that key, the session ran without the organization's policy or with a stale cached copy.","severity":"low","cvss":2.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@anthropic-ai/claude-code","fixed":["2.1.260"],"affected":">= 2.0.68, < 2.1.260","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","claude-code","cwe-696","enterprise","npm","team"],"not_affected_if":["auto-updated","endpoint-managed-settings","no-stored-api-key"],"how_to_check":"- Check the installed version with `claude --version` and compare it against the affected range below.\n- Look for a stored API key in Claude Code's configuration if the machine is used with an Enterprise or Team account.","fix":"- `@anthropic-ai/claude-code` `2.1.260`","status":"open","published_at":"2026-09-29T21:44:55+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","triaged_at":"2026-11-09T23:01:19+00:00","updated_at":"2026-11-09T23:01:19+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T23:01:19Z","model":"claude-haiku-5-5","output":{"fix":"- `@anthropic-ai/claude-code` `2.1.260`","reach":"local","title":"Claude Code: stored API key overrides enterprise managed settings policy","impact":"medium","summary":"Claude Code could pick a stored API key over a valid Enterprise or Team sign-in when fetching organization server-managed settings. When the settings endpoint rejected that key, the session ran without the organization's policy or with a stale cached copy.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["claude-code","enterprise","team","npm"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Organization policy is skipped while the session runs as the organization's account.","analyst_note":"","how_to_check":"- Check the installed version with `claude --version` and compare it against the affected range below.\n- Look for a stored API key in Claude Code's configuration if the machine is used with an Enterprise or Team account.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["endpoint-managed-settings","auto-updated","no-stored-api-key"],"who_is_affected":"Organizations using Claude for Enterprise or Claude for Work (Team) with server-managed settings, on Claude Code from `2.0.68` up to before `2.1.260`. Exploitation requires local access to a device holding a stored API key, and endpoint-managed (MDM or file-based) settings were not affected. Standard auto-update users already have the fix; manual updaters should move to `2.1.260`.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000786,"input_tokens":4962,"output_tokens":580,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-103012':18A,26A '-2026':17A,25A '-696':38B '/claude-code':30A '/login':102C '2.0.68':252C '2.1.260':293C '2.1.38':260C 'access':207C 'account':142C,202C 'addit':222C 'advis':288C 'affect':243C,249C 'ahead':109C 'ai':29A,32B,302C 'ai-tool':31B 'alreadi':282C 'anthropic':28A 'anthropic-ai':27A 'api':8A,48B,91C,215C 'appli':4A,185C 'authent':136C 'auto':276C 'auto-upd':275C 'avail':267C 'base':239C 'becam':266C 'cach':85B,178C,231C 'case':221C 'chang':193C 'claud':35B,42B,87C,95C,115C,244C,253C,273C 'claude-cod':34B 'code':36B,43B,88C,96C,274C 'configur':108C 'continu':195C 'copi':86B,179C,188C 'could':44B 'cve':16A,24A 'cwe':37B 'deni':165C 'devic':210C 'direct':105C 'earlier':101C 'endpoint':69B,146C,233C 'endpoint-manag':232C 'enterpris':13A,39B,53B,116C,139C,246C 'even':131C 'exampl':98C 'exist':180C 'fetch':60B,123C 'file':238C 'file-bas':237C 'fix':281C 'gfvf':21A 'ghsa':20A 'ghsa-gfvf-j8jh-jxxw':19A 'issu':308C 'j8jh':22A 'jxxw':23A 'kept':184C 'key':9A,49B,72B,92C,150C,216C 'later':191C,295C 'local':206C 'lock':173C 'machin':183C 'manag':1A,64B,129C,160C,171C,226C,234C,264C 'managed-on':170C 'manual':285C 'mdm':235C 'model':167C 'no-polici':218C 'npm':40B 'nvidia':301C 'oper':197C 'organ':61B,78B,125C,156C,200C,247C,257C 'perform':284C 'permiss':164C 'pick':45B 'polici':80B,161C,192C,220C 'prefer':11A 'previous':177C,229C 'ran':75B 'receiv':190C,279C 'red':303C 'reject':70B,147C 'report':306C 'requir':205C,223C 'restrict':168C 'rule':166C 'select':89C 'server':63B,128C,159C,263C 'server-manag':62B,127C,158C,262C 'session':74B,134C,152C 'set':2A,65B,68B,130C,145C,227C,240C,265C 'sign':15A,57B,120C 'sign-in':14A,56B,119C 'stale':84B,187C 'standard':272C 'start':153C 'store':7A,47B,93C,149C,214C 'tama':299C 'team':41B,55B,118C,141C,256C,304C 'thank':296C 'though':132C 'tool':33B 'trigger':203C 'updat':277C,286C,290C 'user':112C,270C,283C 'valid':52B,114C 'version':251C,259C,292C 'voro':300C 'without':76B,154C,189C 'work':255C 'written':104C","nicknames":[],"mitigations":[],"who_affected":"Organizations using Claude for Enterprise or Claude for Work (Team) with server-managed settings, on Claude Code from `2.0.68` up to before `2.1.260`. Exploitation requires local access to a device holding a stored API key, and endpoint-managed (MDM or file-based) settings were not affected. Standard auto-update users already have the fix; manual updaters should move to `2.1.260`.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["claudecode"],"ptokens":["ai","anthropic","claude","code"],"labels":["aitooling","claudecode","cwe696","enterprise","low","npm","team"],"campaign_type":null,"search_a":"'-103012':18A,26A '-2026':17A,25A '/claude-code':30A 'ai':29A 'anthropic':28A 'anthropic-ai':27A 'api':8A 'appli':4A 'cve':16A,24A 'enterpris':13A 'gfvf':21A 'ghsa':20A 'ghsa-gfvf-j8jh-jxxw':19A 'j8jh':22A 'jxxw':23A 'key':9A 'manag':1A 'prefer':11A 'set':2A 'sign':15A 'sign-in':14A 'store':7A","search_b":"'-696':38B 'ai':32B 'ai-tool':31B 'api':48B 'cach':85B 'claud':35B,42B 'claude-cod':34B 'code':36B,43B 'copi':86B 'could':44B 'cwe':37B 'endpoint':69B 'enterpris':39B,53B 'fetch':60B 'key':49B,72B 'manag':64B 'npm':40B 'organ':61B,78B 'pick':45B 'polici':80B 'ran':75B 'reject':70B 'server':63B 'server-manag':62B 'session':74B 'set':65B,68B 'sign':57B 'sign-in':56B 'stale':84B 'store':47B 'team':41B,55B 'tool':33B 'valid':52B 'without':76B","search_c":"'/login':102C '2.0.68':252C '2.1.260':293C '2.1.38':260C 'access':207C 'account':142C,202C 'addit':222C 'advis':288C 'affect':243C,249C 'ahead':109C 'ai':302C 'alreadi':282C 'api':91C,215C 'appli':185C 'authent':136C 'auto':276C 'auto-upd':275C 'avail':267C 'base':239C 'becam':266C 'cach':178C,231C 'case':221C 'chang':193C 'claud':87C,95C,115C,244C,253C,273C 'code':88C,96C,274C 'configur':108C 'continu':195C 'copi':179C,188C 'deni':165C 'devic':210C 'direct':105C 'earlier':101C 'endpoint':146C,233C 'endpoint-manag':232C 'enterpris':116C,139C,246C 'even':131C 'exampl':98C 'exist':180C 'fetch':123C 'file':238C 'file-bas':237C 'fix':281C 'issu':308C 'kept':184C 'key':92C,150C,216C 'later':191C,295C 'local':206C 'lock':173C 'machin':183C 'manag':129C,160C,171C,226C,234C,264C 'managed-on':170C 'manual':285C 'mdm':235C 'model':167C 'no-polici':218C 'nvidia':301C 'oper':197C 'organ':125C,156C,200C,247C,257C 'perform':284C 'permiss':164C 'polici':161C,192C,220C 'previous':177C,229C 'receiv':190C,279C 'red':303C 'reject':147C 'report':306C 'requir':205C,223C 'restrict':168C 'rule':166C 'select':89C 'server':128C,159C,263C 'server-manag':127C,158C,262C 'session':134C,152C 'set':130C,145C,227C,240C,265C 'sign':120C 'sign-in':119C 'stale':187C 'standard':272C 'start':153C 'store':93C,149C,214C 'tama':299C 'team':118C,141C,256C,304C 'thank':296C 'though':132C 'trigger':203C 'updat':277C,286C,290C 'user':112C,270C,283C 'valid':114C 'version':251C,259C,292C 'voro':300C 'without':154C,189C 'work':255C 'written':104C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-29T21:44:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"98a01053-8a31-4f6d-9aa9-252be161adc6","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-gfvf-j8jh-jxxw","url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-gfvf-j8jh-jxxw","severity":"low","published_at":"2026-09-29T21:44:55+00:00","modified_at":"2026-09-29T21:44:55+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","fetched_at":"2026-11-09T22:53:24+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-103012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103012","severity":null,"published_at":"2026-09-30T12:17:12+00:00","modified_at":"2026-09-30T16:12:10+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110600,"url":"https://github.com/anthropics/claude-code/security/advisories/GHSA-gfvf-j8jh-jxxw","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-29T21:44:55+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}