CVE-2026-103012

Executive Summary

CVE-2026-103012 is an incorrect behavior order vulnerability (CWE-696) in Anthropic Claude Code in which the client selects a locally stored API key ahead of a valid Claude Enterprise or Team account session when fetching server-managed organizational settings. When the settings endpoint rejects that stale or conflicting key, the session silently starts without the organization's server-managed policy (permission deny rules, model restrictions, managed-only locks) or continues applying a stale cached policy copy, while still operating under the organization's authenticated account.

The flaw affects Claude for Enterprise organizations from version 2.0.68 and Claude for Work / Team organizations from version 2.1.38, requires local access to a device holding such a stored API key, and does not affect endpoint-managed settings delivered via MDM or file-based configuration. The impact is a policy-enforcement bypass — not direct code execution or credential exfiltration — that can leave managed controls unenforced on affected developer endpoints.

Technical Analysis

The root cause is a credential/precedence resolution flaw classified as CWE-696, "Incorrect Behavior Order." Claude Code, when the client needs to contact the organization's server-managed settings endpoint to retrieve managed policy, selects an API key stored by Claude Code — for example from an earlier /login interaction or written directly into its configuration — ahead of the user's valid Claude Enterprise or Team sign-in.

The essential sequence is:

1. The session itself authenticates with the Enterprise or Team account (the user's identity is valid and the session is associated with the organization).
2. A separate stored API key exists on the device from a prior /login flow or from direct configuration entry.
3. For the purpose of fetching server-managed settings, the client prefers the stored API key over the Enterprise/Team session credential.
4. The settings endpoint rejects the stored key.
5. The client proceeds without the organization's server-managed policy, or, if a previously cached copy of that policy exists on the machine, keeps applying that stale copy and never receives subsequent policy changes.

Two distinct outcomes are therefore possible:

• No-policy outcome: no managed settings had previously been cached on the machine, so the session starts with no organization policy at all. This requires both the stored API key condition and the absence of any prior managed-settings cache.
• Stale-policy outcome: a cached copy of the managed settings exists. The client continues applying that copy, so later policy changes (updated permission deny rules, new model restrictions, additional managed-only locks) are never applied. This is a "frozen configuration" failure rather than an absent-configuration failure.

The client continues to operate as the organization's account in both cases — the failure is confined to policy retrieval and enforcement, not to authentication or authorization of the underlying user identity.

Affected surface: Claude Code client deployments where users have both an Enterprise/Team sign-in and a locally stored API key, including keys written directly to configuration. The description explicitly scopes out endpoint-managed settings delivered via MDM or file-based mechanisms, which were not affected. The description does not specify the exact configuration file path, environment variable name, or settings endpoint URL involved, and no further endpoint, parameter, or code-level detail is provided in the available data; those specifics are not reproduced here.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template is available for this CVE. The following chain is inferred from the vulnerability class and the reported behavior; no specific function names, endpoints, or parameter names beyond those given in the advisory are asserted.

1. Reconnaissance / target identification. An adversary or insider requires local access to a device that (a) runs an affected Claude Code version, (b) has an active Claude Enterprise or Team sign-in, and (c) holds a stored API key from an earlier /login or from configuration written directly to disk. This is a post-access precondition; there is no remote or pre-authentication vector described.

2. Triggering the flaw. Once on the device, the attacker ensures both credential forms are present — an existing stored API key is sufficient, and no alteration to the Enterprise/Team session is required. On the next client start or settings refresh, Claude Code resolves the stored API key ahead of the Enterprise/Team sign-in for the settings fetch, the settings endpoint rejects that key, and the client falls through to one of the two outcomes described above. No payload injection is required; the misordering of credential selection is the trigger.

3. Execution / failure mode. If no managed settings cache exists on the machine, the session begins with no server-managed policy. If a cache exists, the client keeps applying the stale cached copy. In neither case does the client receive the current policy from the organization's endpoint.

4. Post-exploitation impact. With server-managed policy unenforced — either absent or stale — the controls that would normally constrain the session (permission deny rules, model restrictions, managed-only locks) are not applied. On a stale-cache machine, any policy changes made by the organization after the cache was written are silently ignored. The session still executes as the organization's account, which is the principal risk: activity and results are attributable to the enterprise identity while operating under obsolete or absent guardrails. The flaw does not itself yield credential theft, code execution, or network-level access; it degrades a control plane.

Impact Assessment

• Confidentiality: no direct disclosure of secrets is described. Rating for C:N.
• Integrity: primary impact. Server-managed policy is either not applied or is frozen at a prior state, so permission deny rules, model restrictions, and managed-only locks may not reflect current organizational intent. Rating I:H.
• Availability: no availability impact is described. Rating A:N.
• Attack Vector: Local (AV:L) — the advisory explicitly states that triggering required local access to a device with a stored API key.
• Attack Complexity: Low (AC:L) — no race condition or special condition beyond the presence of a stored key, and for the no-policy outcome, absence of a prior cache.
• Privileges Required: Low (PR:L) — local user access to the device.
• User Interaction: None (UI:N) — the client's own settings fetch triggers the misordered credential selection on start.
• Scope: Unchanged (S:U).

No CVSS score or vector is provided by the advisory or NVD at time of writing; the vector above is an analyst-derived estimate consistent with the described preconditions and must not be treated as an official score.

Blast radius and business impact. Affected deployments are organizations using Claude for Enterprise (from 2.0.68) or Claude for Work / Team (from 2.1.38). The population at risk is the subset of managed developer endpoints where a stored API key coexists with an Enterprise/Team sign-in. Business impact is governance-related: organizations relying on server-managed settings for compliance enforcement, data-handling restrictions, or model governance may believe controls are active while those controls are absent or stale on specific machines. The stale-policy case is the more insidious of the two, because dashboards or assumptions at the console may show a current policy that the endpoint is not actually applying. Endpoint-managed (MDM or file-based) settings are unaffected, so organizations delivering policy through those channels are not in scope.

Detection Guidance

Because this vulnerability manifests as a client-side credential-precedence and policy-fetch failure, detection centers on the Claude Code client, its local configuration state, and the settings-fetch behavior rather than on network exploitation signatures. The rules below are constructed for the behavior described and must be tuned to your environment; they do not rely on any endpoint, parameter, or filename not provided in the advisory.

Sigma Rule

title: Claude Code Server-Managed Settings Fetch Rejected / Stored API Key Precedence
id: 8f3a1c2e-5b7d-4a91-9c6e-2d0f4b7a1e35
status: experimental
description: Detects Claude Code sessions operating under an Enterprise/Team account where the
  server-managed settings fetch is rejected (stored API key preferred over the signed-in session),
  resulting in absent or stale managed policy.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-103012
author: Valters IT Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1552
  - attack.t1562.001
logsource:
  product: claude_code
  service: application
detection:
  selection_auth:
    EventType: 'settings_fetch'
    AccountType:
      - 'enterprise'
      - 'team'
  selection_failure:
    Result: 'rejected'
    AuthSource: 'stored_api_key'
  selection_policy:
    - PolicyState: 'absent'
    - PolicyState: 'stale_cache_used'
  condition: selection_auth and selection_failure and selection_policy
falsepositives:
  - Legitimate key rotation / expiry causing a one-off settings fetch failure
  - Test machines intentionally operating without managed policy
level: high

YARA Rule

rule CVE_2026_103012_Claude_Code_Stored_Key_Precedence
{
    meta:
        author      = "Valters IT Threat Intelligence"
        description = "Detects Claude Code configuration artifacts indicating a stored API key alongside an Enterprise/Team sign-in, the precondition and failure pattern for CVE-2026-103012"
        reference   = "https://nvd.nist.gov/vuln/detail/CVE-2026-103012"
        date        = "2026-01-01"
        severity    = "high"

    strings:
        $cfg1 = "apiKey" nocase
        $cfg2 = "api_key" nocase
        $cfg3 = "ANTHROPIC_API_KEY" nocase
        $ent1 = "enterprise" nocase
        $ent2 = "team" nocase
        $pol1 = "managedSettings" nocase
        $pol2 = "server-managed" nocase
        $pol3 = "permission deny" nocase

    condition:
        filesize < 2MB and
        (any of ($cfg*)) and
        (any of ($ent*)) and
        (any of ($pol*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103012 Claude Code server-managed settings fetch rejected - stored API key precedence (policy bypass)"; flow:to_server,established; http.method; content:"GET"; http.header; content:"anthropic"; nocase; http.uri; content:"settings"; nocase; http.stat_code; content:"401"; sid:10301201; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-103012, confidence low; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103012; classtype:policy-violation;)

Note: this is a behavioral, low-confidence signature. It matches the rejection of a settings-fetch request over HTTP and is intended for telemetry enrichment, not as a high-fidelity indicator. Organizations that cannot observe the settings host should rely on the endpoint/log-based rules instead.

Elastic Detection

sequence by host.id, user.name with maxspan=5m
  [ any where event.category == "authentication" and
      event.action == "settings_fetch" and
      claude.account.type in ("enterprise", "team") and
      claude.auth.source == "stored_api_key" ]
  [ any where event.action in ("settings_fetch_rejected", "policy_not_applied") and
      claude.policy.state in ("absent", "stale_cache_used") ]

Splunk SPL Query

index=claude_code sourcetype=claude:client
| search (account_type="enterprise" OR account_type="team") auth_source="stored_api_key"
| stats count min(_time) as first_seen max(_time) as last_seen
        values(policy_state) as policy_states
        values(settings_fetch_result) as fetch_results
        by host user account_type
| where fetch_results="rejected"
        AND (policy_states="absent" OR policy_states="stale_cache_used")
| eval first_seen=strftime(first_seen,"%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen,"%Y-%m-%d %H:%M:%S")
| sort - last_seen
| table host user account_type auth_source fetch_results policy_states first_seen last_seen

Wazuh OSSEC Rule

<group name="claude_code,cve-2026-103012,">
  <rule id="103012" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">settings_fetch</field>
    <field name="account_type">enterprise|team</field>
    <field name="auth_source">stored_api_key</field>
    <field name="result">rejected</field>
    <description>CVE-2026-103012: Claude Code preferred a stored API key over the Enterprise/Team session for server-managed settings fetch; request rejected.</description>
    <mitre>
      <id>T1552</id>
      <id>T1562.001</id>
    </mitre>
    <group>policy_bypass,</group>
  </rule>

  <rule id="103013" level="12">
    <if_sid>103012</if_sid>
    <field name="policy_state">absent|stale_cache_used</field>
    <description>CVE-2026-103012: Claude Code session started without current server-managed policy (absent or stale cache). Managed controls may be unenforced.</description>
    <mitre>
      <id>T1562.001</id>
    </mitre>
    <group>policy_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The vendor advisory states a fixed version; the automated tracking sources did not corroborate a patch artifact, so treat the fix as vendor-declared rather than independently verified.

1) Immediate mitigations

• Remove or neutralize stored Claude Code API keys on managed endpoints where an Enterprise or Team sign-in is the intended primary credential, so the client cannot select a stale key ahead of the session for the settings fetch. Inventory devices for keys introduced via /login or written directly to configuration.
• Where feasible pending upgrade, prefer endpoint-managed settings (MDM or file-based). The advisory states these were not affected, so shifting policy delivery to those channels removes the exposure for the enforced controls.
• Invalidate any previously cached copy of server-managed settings on affected endpoints before reintroducing managed policy, to avoid the stale-cache outcome persisting after remediation.
• Restrict local access to developer endpoints that hold such keys, since triggering required local access per the advisory. This is a defense-in-depth measure, not a fix.

2) Patch / upgrade steps

• Upgrade Claude Code to version 2.1.260 or later on all manual-update installations. This is the vendor-stated fixed version.
• Users on standard Claude Code auto-update have already received the fix; verify client version on the fleet to confirm the auto-update path actually applied.
• Do not rely on the absence of a CVE score in exploit-tracking feeds as evidence of no risk; the vendor fix exists but automated patch corroboration does not.

3) Long-term hardening

• Treat client-side credential precedence as a control-plane risk: require that managed-policy fetches are always performed with the organization's session credential and fail closed if the policy cannot be retrieved, rather than continuing without it or with a cache.
• Monitor and alert on the two failure states — policy absence and stale-cache use — as first-class security events (see Detection Guidance), so governance gaps surface rather than remain silent.
• Where the product supports it, enforce managed-only locks through endpoint-managed (MDM/file-based) delivery in addition to server-managed settings, so a single fetch failure cannot remove all guardrails.
• Establish a fleet inventory of Claude Code versions and credential artifacts on managed endpoints, and review it after each client release to catch precedence regressions early.

References

1. NVD — CVE-2026-103012: https://nvd.nist.gov/vuln/detail/CVE-2026-103012
2. Anthropic security advisory / Claude Code release notes for version 2.1.260 (vendor-stated fixed version; consult the official Anthropic channels for the authoritative advisory text).
3. CWE-696 — Incorrect Behavior Order: https://cwe.mitre.org/data/definitions/696.html
4. MITRE ATT&CK — T1552 Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
5. MITRE ATT&CK — T1562.001 Impair Defenses: Disable or Modify Tools: https://attack.mitre.org/techniques/T1562/001/

No exploitation in the wild, public PoC, or named threat actor campaign is associated with CVE-2026-103012 in the available data. The issue was reported by Tamas Voros of the NVIDIA AI Red Team. This CVE is not listed in CISA KEV.