---
id: "TECH-202611-ackg3u"
page: "https://infrastack.ai/live/TECH-202611-ackg3u"
kind: "technique"
aliases: []
title: "Claude Code before 2.1.321 can send MCP sign-in secrets such as refresh tokens to another host when an MCP server redirects, and some Bash commands could skip the sandbox or permission prompts (Anthropic fixed in 2.1.321, no CVE)"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Claude Code", "fixed": [], "vendor": "Anthropic", "package": "@anthropic-ai/claude-code", "fixed_in": "2.1.321", "ecosystem": "npm"}]
ecosystems: []
tags: ["early-warning", "technique"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-09T19:50:28+00:00"
updated_at: "2026-11-09T19:50:53+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-09T19:50:28+00:00"}]
exploit_sources: []
---

# Claude Code before 2.1.321 can send MCP sign-in secrets such as refresh tokens to another host when an MCP server redirects, and some Bash commands could skip the sandbox or permission prompts (Anthropic fixed in 2.1.321, no CVE)

Link for people: https://infrastack.ai/live/TECH-202611-ackg3u (this .md is for agents)

Anthropic's Claude Code v2.1.321 release notes (9 Nov 2026) list security fixes: MCP OAuth requests sent secrets such as refresh tokens to another host when a server redirected them; a case where a read-only Bash command ran outside the sandbox without a permission prompt; Bash permission checks judging a file write from the wrong folder and not prompting; deny rules and protected-file prompts not applying to the file a cp or mv into a directory writes. All Claude Code versions before 2.1.321 are affected per the notes; the first affected version, any exploitation and any CVE are unknown. Source is the vendor's release notes only.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:Claude Code affected range not listed fixed no fixed version listed

## How to check

Run 'claude --version': anything below 2.1.321 is affected. If you use remote (OAuth) MCP servers, check whether any MCP server you sign in to answers OAuth requests with redirects to another host; which hosts received tokens is unknown. Review deny rules that rely on blocking writes to protected files via cp or mv.

## Fix

Update Claude Code to 2.1.321 or later (claude update, or npm i -g @anthropic-ai/claude-code@latest). If you sign in to third-party or untrusted MCP servers over OAuth, sign out and back in (claude mcp login) after updating to rotate refresh tokens.

## Timeline

- 2026-11-09T19:50:28+00:00 analyst

## Documents

- [describes] Claude Code releases: v2.1.321 https://github.com/anthropics/claude-code/releases/tag/v2.1.321

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_