Claude Code incorrectly prioritized a locally stored API key, which may have been saved during an earlier login or directly in the application configuration, over the credentials of the authenticated user. When the server rejected that stored key, the application continued to operate under the stale key without loading the organization’s server‑managed policy, such as permission deny rules or model restrictions. This allows an attacker who can read the local configuration or recover a stored key to run the application in an unmanaged mode, potentially using enterprise resources without the intended safeguards.

Anthropic’s Claude Code was affected for Enterprise users running version 2.0.68 and for Work (Team) users running version 2.1.38, both of which had recently introduced server‑managed settings. Users who have enabled auto‑updates received the fix automatically; users performing manual updates should upgrade to version 2.1.260 or later.

The CVSS score of 2 indicates a low severity vulnerability. No evidence of public exploits exists and the EPSS score is not available; it is therefore not currently tracked for exploitation potential. The vulnerability requires local access to a device that holds the compromised API key and no previously cached policy, making it an attack requiring physical or remote control of the machine. Because it does not allow remote code execution or privilege escalation beyond bypassing policy controls, it is unlikely to be widely exploited.