# CVE-2026-103012: Anthropic Claude Code managed settings bypass with stored API key

Source: https://junglewise.ai/threats/cve-2026-103012-claude-code-selected-an-api-key-stored-by-claude-code-for  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-103012 · Severity: info · Published 2026-09-30

Claude Code is an AI coding assistant that enterprise organizations deploy with server-managed security policies to restrict model usage, deny certain operations, and enforce compliance rules. When a locally-stored API key was available on a developer's machine, Claude Code would use it instead of the user's Enterprise or Team sign-in when fetching those policies, causing the application to either run without security restrictions or apply outdated cached policies while still operating under the organization's account. An attacker with local access to the machine could exploit this to bypass organizational security controls.

Technologies: [Anthropic Claude Code](https://junglewise.ai/threats/technologies/claude-code). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic).

## Quick answers

**Is CVE-2026-103012 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103012 being exploited in the wild.

**How severe is CVE-2026-103012?** Informational severity, published 30 September 2026.

**Which products and versions are affected?** Anthropic Claude Code 2.0.68 to 2.1.259 (Enterprise); 2.1.38 to 2.1.259 (Team).

**Is there a fix for CVE-2026-103012?** A patch was published on 2026-09-30: Version 2.1.260 and later Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103012 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-103012?** Check whether you run Anthropic Claude Code at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Claude Code improperly prioritizes a stored API key over valid Enterprise/Team authentication when requesting server-managed settings, a logic error in credential selection during policy fetch. The vulnerability requires local device access to exploit; if no cached settings existed, policies would not load at all. Endpoint-managed (MDM/file-based) settings were unaffected. The issue is fixed in version 2.1.260; Enterprise organizations were affected from 2.0.68 and Team organizations from 2.1.38.

## Affected products

- Anthropic Claude Code 2.0.68 to 2.1.259 (Enterprise); 2.1.38 to 2.1.259 (Team)

## Timeline

- 2026-09-30: disclosed
- 2026-09-30: patched: Version 2.1.260 and later

## References

- [https://github.com/anthropics/claude-code/security/advisories/GHSA-gfvf-j8jh-jxxw](https://github.com/anthropics/claude-code/security/advisories/GHSA-gfvf-j8jh-jxxw)

## Related threats

- [Anthropic Claude Code time-of-check-to-time-of-use in Edit tool](https://junglewise.ai/threats/cve-2026-88968-claude-code-is-an-agentic-coding-tool-prior-to-2-1-251-the-edit)
- [Anthropic Claude Code plugin hash pin bypass in git checkout](https://junglewise.ai/threats/cve-2026-86063-claude-code-plugin-hash-pin-bypass-allows-bypass-of-hash-pinning)
- [Anthropic Claude Code sandbox escape via git worktree path confusion](https://junglewise.ai/threats/cve-2026-55607-anthropic-claude-code-sandbox-escape-via-git-worktree-path)
- [Anthropic Claude Code insecure temporary file in copy command](https://junglewise.ai/threats/cve-2026-46406-anthropic-claude-code-insecure-temporary-file-in-copy-command)
- [Anthropic Claude Code data exfiltration via HuggingFace allowlist bypass](https://junglewise.ai/threats/cve-2026-54316-anthropic-claude-code-data-exfiltration-via-huggingface-allowlist)