{"id":"TECH-202611-ackg3u","kind":"technique","aliases":[],"related":[],"title":"Claude Code before 2.1.321 can send MCP sign-in secrets such as refresh tokens to another host when an MCP server redirects, and some Bash commands could skip the sandbox or permission prompts (Anthropic fixed in 2.1.321, no CVE)","description":null,"summary":"Anthropic's Claude Code v2.1.321 release notes (9 Nov 2026) list security fixes: MCP OAuth requests sent secrets such as refresh tokens to another host when a server redirected them; a case where a read-only Bash command ran outside the sandbox without a permission prompt; Bash permission checks judging a file write from the wrong folder and not prompting; deny rules and protected-file prompts not applying to the file a cp or mv into a directory writes. All Claude Code versions before 2.1.321 are affected per the notes; the first affected version, any exploitation and any CVE are unknown. Source is the vendor's release notes only.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Claude Code","fixed":[],"vendor":"Anthropic","package":"@anthropic-ai/claude-code","fixed_in":"2.1.321","ecosystem":"npm"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"Run 'claude --version': anything below 2.1.321 is affected. If you use remote (OAuth) MCP servers, check whether any MCP server you sign in to answers OAuth requests with redirects to another host; which hosts received tokens is unknown. Review deny rules that rely on blocking writes to protected files via cp or mv.","fix":"Update Claude Code to 2.1.321 or later (claude update, or npm i -g @anthropic-ai/claude-code@latest). If you sign in to third-party or untrusted MCP servers over OAuth, sign out and back in (claude mcp login) after updating to rotate refresh tokens.","status":"open","published_at":null,"first_seen_at":"2026-11-09T19:50:28+00:00","triaged_at":"2026-11-09T19:50:28+00:00","updated_at":"2026-11-09T19:50:53+00:00","category":"ai-tooling","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':42A '2.1.321':4A,38A,136B '2026':59B '9':57B 'ackg3u':43A 'affect':138B,144B 'anoth':17A,73B 'anthrop':35A,50B 'appli':119B 'bash':26A,87B,97B 'case':81B 'check':99B 'claud':1A,52B,132B 'claude':44A 'code':2A,45A,53B,133B 'command':27A,88B 'could':28A 'cp':124B 'cve':40A,150B 'deni':111B 'directori':129B 'earli':47B 'early-warn':46B 'exploit':147B 'file':102B,116B,122B 'first':143B 'fix':36A,62B 'folder':107B 'host':18A,74B 'judg':100B 'list':60B 'mcp':7A,21A,63B 'mv':126B 'note':56B,141B,159B 'nov':58B 'oauth':64B 'outsid':90B 'per':139B 'permiss':33A,95B,98B 'prompt':34A,96B,110B,117B 'protect':115B 'protected-fil':114B 'ran':89B 'read':85B 'read-on':84B 'redirect':23A,78B 'refresh':14A,70B 'releas':55B,158B 'request':65B 'rule':112B 'sandbox':31A,92B 'secret':11A,67B 'secur':61B 'send':6A 'sent':66B 'server':22A,77B 'sign':9A 'sign-in':8A 'skip':29A 'sourc':153B 'tech':41A 'techniqu':49B 'token':15A,71B 'unknown':152B 'v2.1.321':54B 'vendor':156B 'version':134B,145B 'warn':48B 'without':93B 'write':103B,130B 'wrong':106B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["claudecode"],"ptokens":["claude","code"],"labels":["aitooling","earlywarning","medium","technique"],"campaign_type":"exploitation","search_a":"'-202611':42A '2.1.321':4A,38A 'ackg3u':43A 'anoth':17A 'anthrop':35A 'bash':26A 'claud':1A 'claude':44A 'code':2A,45A 'command':27A 'could':28A 'cve':40A 'fix':36A 'host':18A 'mcp':7A,21A 'permiss':33A 'prompt':34A 'redirect':23A 'refresh':14A 'sandbox':31A 'secret':11A 'send':6A 'server':22A 'sign':9A 'sign-in':8A 'skip':29A 'tech':41A 'token':15A","search_b":"'2.1.321':136B '2026':59B '9':57B 'affect':138B,144B 'anoth':73B 'anthrop':50B 'appli':119B 'bash':87B,97B 'case':81B 'check':99B 'claud':52B,132B 'code':53B,133B 'command':88B 'cp':124B 'cve':150B 'deni':111B 'directori':129B 'earli':47B 'early-warn':46B 'exploit':147B 'file':102B,116B,122B 'first':143B 'fix':62B 'folder':107B 'host':74B 'judg':100B 'list':60B 'mcp':63B 'mv':126B 'note':56B,141B,159B 'nov':58B 'oauth':64B 'outsid':90B 'per':139B 'permiss':95B,98B 'prompt':96B,110B,117B 'protect':115B 'protected-fil':114B 'ran':89B 'read':85B 'read-on':84B 'redirect':78B 'refresh':70B 'releas':55B,158B 'request':65B 'rule':112B 'sandbox':92B 'secret':67B 'secur':61B 'sent':66B 'server':77B 'sourc':153B 'techniqu':49B 'token':71B 'unknown':152B 'v2.1.321':54B 'vendor':156B 'version':134B,145B 'warn':48B 'without':93B 'write':103B,130B 'wrong':106B","search_c":"","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T19:22:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-ackg3u","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-09T19:50:28+00:00","fetched_at":"2026-11-09T19:50:28+00:00","note":null}],"documents":[{"id":109471,"url":"https://github.com/anthropics/claude-code/releases/tag/v2.1.321","title":"Claude Code releases: v2.1.321","kind":"release","source":"release","publisher":null,"text":"v2.1.321\n\nWhat's changed Added Claude Fable 5.2 ( claude-fable-5-2 ), now the default Fable model — 1M context, $8/$40 per Mtok with $0.20/Mtok cache reads Added --settings <file> to claude remote-control , which applies a settings file to every session it starts; if the file changes, no new session starts until you restart claude remote-control Fixed MCP OAuth requests sending secrets such as refresh tokens to another host when a server redirected them Fixed a case where a read-only Bash command ran outside the sandbox without a permission prompt Fixed a case where Bash permission checks judged a file write from the wrong folder and didn't prompt Fixed deny rules and protected-file prompts not applying to the file that a cp or mv into a directory writes Fixed the \"Draws from usage credits\" note showing after a switch to Fable on Enterprise seats whose plan includes Fable Fixed the fallback model sometimes declining a request or mentioning a stopped response when the first model was blocked before replying Fixed claude mcp login printing a SEP-2352 issuer warning each time you sign in again to a server that Claude Code registered with Fixed NotebookEdit deleting or overwriting a notebook's first cell when the call named no cell, on network paths (UNC shares, WSL folders, /net mounts) Fixed Edit changing the first of several matches, replacing a whole file on an empty old_string , or editing a notebook as text, on network paths (UNC shares, WSL folders, /net mounts) Fixed /config showing Manual as the default permission mode when new sessions start in auto mode; pressing Space on \"Auto (default)\" now saves Don't Ask, not Plan Windows: Fixed FileChanged hooks stopping for paths set through watchPaths after the first shell command, when the session's working directory had a lowercase drive letter Fixed --plugin-dir . and --plugin-dir ./builtin writing generated type files for Claude Code's built-in plugins into a builtin folder Fixed context usage estimates overcounting tool definitions when exact token counts are unavailable Fixed /compact showing twice in Remote Control on web and mobile Fixed plugin auto-updates and /plugin marketplace updates downloading a plugin again for each worktree or folder of a repository Fixed auto mode losing a background subagent's report that had started a turn when the conversation was compacted before Claude answered it Fixed project skills, commands and agents staying missing after their folder was removed and came back mid-session, such as with git stash , including after entering a worktree Fixed claude -p sometimes telling Claude that background commands get 30 minutes when they are stopped after 10 Fixed pkill , pgrep and pidwait in cloud sessions matching the session's own parent processes Fixed Claude in Chrome and computer use server processes staying alive after their parent exits behind a proxy that stalls connections Fixed a large hook output pointing Claude to a file that held another hook's output from the same tool call Fixed apps that embed Claude Code getting their own PreToolUse hook's ask reason instead of another hook's when both asked Fixed a PreToolUse hook's ask being lost when another hook's defer finished first and could not be honored Fixed a rare crash on permission prompts and background tasks Fixed project skills, commands and agents disappearing from the menu in SDK and desktop sessions after Claude entered a worktree Fixed /desktop on macOS saying Claude Desktop is not installed when it is in ~/Applications Fixed OpenTelemetry repository attributes ( vcs.* ) missing from Claude Desktop sessions that start on a pre-started process Fixed WebFetch passing \"No response from model\" to Claude as page content when the model reading the page returned no text; the call now fails with a clear error Fixed screen reader mode delaying the prompt at startup when the system clock moved back while Claude Code was starting Fixed a command's panel sometimes not coming back after a dialog closed","published_at":"2026-11-09T19:22:30+00:00","relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}