---
id: "CVE-2026-126658"
page: "https://infrastack.ai/live/CVE-2026-126658"
kind: "vulnerability"
aliases: ["CVE-2026-126658"]
title: "ByteStash: deactivated accounts keep API key access to snippets and MCP"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "api-keys", "bytestash", "mcp", "self-hosted"]
not_affected_if: ["no-api-keys-issued", "version-1.6.2-or-later"]
published_at: "2026-11-11T13:17:23+00:00"
first_seen_at: "2026-11-11T13:27:16+00:00"
updated_at: "2026-11-11T13:29:25+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-126658", "first_seen_at": "2026-11-11T13:27:16+00:00"}]
exploit_sources: []
---

# ByteStash: deactivated accounts keep API key access to snippets and MCP

Link for people: https://infrastack.ai/live/CVE-2026-126658 (this .md is for agents)

ByteStash, a self-hosted code snippet manager, does not check whether an account is still active when validating an API key. Someone holding the API key of a deactivated account can keep reading, creating, changing and deleting that account's snippets, and use every MCP tool.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ByteStash version; affected versions are `1.5.10` up to but not including `1.6.2`.
- Review whether any API keys belonging to deactivated or removed users are still valid.

## Fix

- Move ByteStash to `1.6.2` or later.

## Timeline

- 2026-11-11T13:27:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-126658

## Documents

- [advisory] Vendor advisory: github.com https://github.com/jordan-dalby/ByteStash/security/advisories/GHSA-26m9-ww2j-3cr5
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/bytestash-1.5.10-before-1.6.2-insufficient-session-expiration-via-api-keys
- [fix] Patch: github.com https://github.com/jordan-dalby/ByteStash/commit/eb4ecdfc30f2e7d1424137fa7fe3a9eed663218b
- [fix] Release notes: github.com https://github.com/jordan-dalby/ByteStash/releases/tag/v1.6.2

## From the sources

ByteStash 1.5.10 before 1.6.2 contains an insufficient session expiration vulnerability that allows holders of API keys to keep access after account deactivation because validateApiKey never checks account status. Attackers holding a deactivated account's API key can read, create, modify and delete its snippets via /api/snippets and use every MCP tool via /mcp.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_