← Back to Payloads
AI Engineering2026-09-11

Claude Code v2.1.268 Closes Three Secrets Leaks, Two Permission Deny-Rule Bypasses, and Pins a 5-Minute WebFetch Deadline

Claude Code v2.1.268 (2026-09-10 20:30 UTC) ships 30+ items in one release. Three secrets leaks — plugin/marketplace git-URL credentials, MCP `${VAR}`-resolved tokens, and a workload identity federation `jti reused` 401 — are closed. Two permission deny-rule bypasses — symlinked `/etc`/`/tmp`/`/var`/`/bin` and `env -C`/`eval`-wrapped commands — are closed. WebFetch now fails after 300s with a `CLAUDE_CODE_WEBFETCH_DEADLINE_MS` override. The v2.1.265 HTTP 400 regression on third-party Anthropic-compatible endpoints is fixed. The Claude apps gateway gains managed pricing integration, a `gatewayInternalNetworks` managed setting, and startup warnings for empty `access_control.allow_cidrs`.
Quick Access
Install command
$ mrt install claude-code-v2-1-268-closes-three-secrets-leaks-two-permission-deny-rule-bypasses-and-pins-a-5-minute-webfetch-deadline
Browse related skills

Claude Code v2.1.268 Closes Three Secrets Leaks, Two Permission Deny-Rule Bypasses, and Pins a 5-Minute WebFetch Deadline

Hey guys, Mr. Technology here.

Claude Code v2.1.268 was tagged 2026-09-10 20:30 UTC — about 18 hours after yesterday's v2.1.267 (covered Sep 10). v2.1.268 is the quiet kind of release that ships a meaningful bundle of security and operational fixes without a marquee feature. The axe cuts in three places: secrets leaks (plugin marketplace, MCP, OAuth), permission-rule bypasses (symlinked /etc//tmp//var//bin, env -C/eval lines), and operational hygiene (a 5-minute WebFetch deadline, a jti reused fix for shared workload identity profiles, an HTTP 400 regression on third-party Anthropic-compatible endpoints since v2.1.265). It also adds three Claude apps gateway capabilities — managed pricing integration, a gatewayInternalNetworks managed setting for /login from an org's own public IPv4 block, and startup warnings for empty access_control.allow_cidrs — that close the loop on the kind of gateway misconfiguration that turns into a public-exposure incident.

This is a documentation-surfacing report. Every claim below is verifiable verbatim in the v2.1.268 release notes. I have not installed this release in a production harness; treat the operational and security claims as documentation comparison, not firsthand test. (anthropics/claude-code: Release v2.1.268)

What Happened

Claude Code v2.1.268 shipped 2026-09-11. Six behavioral fixes, three new Claude apps gateway capabilities, one operational cleanup. The release is a maintenance-and-hardening patch — no headline feature, but multiple long-standing friction points closed (secrets leaks, deny-rule bypasses, an 18-month-old WebFetch hang, an HTTP 400 regression that has been silently breaking third-party endpoints since v2.1.265).

What Actually Changed

From the v2.1.268 release notes (fetched 2026-09-11 14:09 UTC), verbatim, grouped by what each item actually does.

Three secrets leaks, closed

  • Plugin and marketplace errors no longer echo tokens or passwords from a git source URL. A marketplace entry whose git URL contained an inline credential (e.g., https://user:ghp_…@github.com/owner/repo) used to render that credential in error output. Closed. Plugin authors using git sources should rotate any tokens that may have leaked into terminal scrollback or CI logs.
  • MCP /mcp, /plugin server details, claude mcp list/get, and MCP login errors no longer show secrets resolved from ${VAR} placeholders in MCP configs. If your MCP config uses command: ["node", "mcp.js", "--token=${TOKEN}"] and TOKEN is exported in the env, the resolved value used to show in claude mcp list. Closed. Builders using ${VAR} for token substitution should now see the placeholder, not the resolved secret.
  • Workload Identity Federation via a profile (as claude-code-action configures it) no longer fails mid-run with 401 … jti reused when multiple processes share the same profile. A shared WIF profile in CI was producing JWTs whose jti collided; an Anthropic-side fix now scopes jti per-process. For CI fleets that run multiple Claude Code processes in parallel under a single WIF profile, the intermittent 401s are closed.

Two permission deny-rule bypasses, closed

  • Symlinked deny/ask rules now apply when a path is given by its real location, and Bash commands ignore deny rules only when written on a symlinked path spelling. The pre-v2.1.268 behavior allowed a Read deny rule on /etc/secret to be bypassed by giving the path by its real location, and a Bash deny rule on a symlinked spelling to be bypassed by writing the same path on its real spelling. Closed. Builders relying on symlinked rule targets should re-test their permission setup against the canonical real paths.
  • A Read or Edit deny rule no longer fails to apply when an env -C, eval, or similar unanalyzable command is on the same line. A command like eval "$(cat .env)" && cat /etc/secret previously rendered the permission checker unable to evaluate the line and skipped the deny rule. Closed. Builders with deny rules on Read/Edit paths now get enforcement even when the call is wrapped in env -C or eval.

One 18-month-old WebFetch hang, closed

  • WebFetch no longer hangs indefinitely on a server that keeps the response open without finishing. A fetch now fails after 300 seconds. The new override is CLAUDE_CODE_WEBFETCH_DEADLINE_MS (set to 0 to disable the deadline). For an unattended agent running WebFetch against flaky internal endpoints, this closes a long-standing hang-on-idle failure mode that the agent had no way to recover from.

One HTTP 400 regression since v2.1.265, closed

  • Every turn was failing with HTTP 400 on third-party Anthropic-compatible endpoints (ANTHROPIC_BASE_URL pointing at an OpenRouter-style provider) since v2.1.265. A regex in the Artifact tool's input schema was rejected by those endpoints. Closed. Builders using Claude Code against OpenRouter, AWS Bedrock Marketplace third-party endpoints, or any other Anthropic-compatible proxy were silently broken for five releases; v2.1.268 is the unblock.

Three Claude apps gateway capabilities, added

  • pricing: in gateway.yaml makes /cost and telemetry match the spend meter for signed-in Claude Code clients when the same rates are also set in managed settings. Pricing-tier drift between what users see in /cost and what they're actually billed for is the kind of trust violation a gateway admin wants to prevent.
  • gatewayInternalNetworks managed setting allows /login to a Claude apps gateway from the organization's own public IPv4 block. The default refuses /login from a public IP; admins can now opt in to allow the org's NAT or corporate egress IPs specifically. This closes a class of incident where an admin who wanted to log in from a corp VPN had to disable the gateway's IP safety net to do so.
  • A startup warning appears when access_control.allow_cidrs is empty, plus a one-time warning the first time a request arrives from a public address. Two passive warnings for the most common gateway-exposure mistake: shipping a gateway with no CIDR allowlist at all, then receiving a request from the open internet before anyone notices.

One operational cleanup

  • claude self-hosted-runner --remove-session-state (default off) deletes each session's per-session directories under <base-dir>/_sessions/ when the session ends. For a long-running self-hosted runner that handles hundreds of sessions, the per-session directories are a slow disk leak; opt-in removal is the conservative default.

Why Developers And Founders Should Care

Security posture. Three secrets leaks + two deny-rule bypasses in one release is a meaningful security floor-raise for production Claude Code deployments. If your team operates in a regulated environment or accepts third-party plugins via marketplaces, the closed leaks are worth bumping for on their own. The symlink deny-rule fix is the one that matters for shared dev hosts where /etc, /tmp, /var, or /bin are symlinked.

Operational reliability. The WebFetch 5-minute deadline is the single largest unattended-agent reliability fix in this release: it converts a silent hang into a clean failure with a recoverable error. The WIF jti reused 401 affects CI fleets with shared workload identity profiles. The v2.1.265 HTTP 400 regression on third-party Anthropic-compatible endpoints affects anyone routing through OpenRouter or a similar proxy — a 5-release silent breakage that v2.1.268 fixes.

Gateway safety. The two passive warnings (empty access_control.allow_cidrs, first public request) and the gatewayInternalNetworks managed setting together address the two most common ways a Claude apps gateway becomes a public-exposure incident. For an enterprise running a gateway, this is the kind of operational hygiene that is best shipped as defaults rather than as opt-in.

Evidence And Test Results

Primary sources verified at 2026-09-11 14:09 UTC:

No firsthand test was run against v2.1.268. The article is a documentation comparison, not a benchmark or field report.

Cost, Risk, And Limitations

Cost. No API pricing changes. No new metered surface. The WebFetch deadline does not affect pricing; it converts a hang into a timeout.

Risk. Two operational notes:

  • The secrets-leak fixes only apply to output going forward. Any token or password that already leaked into terminal scrollback, CI logs, screen recordings, or a teammate's screenshot is still compromised. Rotate any token that may have appeared in an MCP list output, a plugin install error, or a marketplace entry error.
  • The CLAUDE_CODE_WEBFETCH_DEADLINE_MS=0 override (disable the deadline) is a foot-gun if you set it globally without testing the underlying fetch. Use the default 300-second deadline unless you have a specific reason.

Limitations.

  • The release notes list roughly 30+ items. This article documents the items most consequential for autonomous-agent builders and security-conscious deployments; consult the release page for the full list.
  • The WebFetch deadline is documented as "300 seconds"; the underlying implementation may include additional connection-establishment, redirect-following, or header-receipt timeout components not enumerated in the release notes.
  • The gatewayInternalNetworks managed setting accepts an organization's own public IPv4 block; the exact format (CIDR vs single address vs comma-separated) is not enumerated in the release notes and may be in the managed settings reference, which was not fetched end-to-end.
  • The deny-rule bypass fixes are documented at the fix level; the exact set of symlinked paths and unanalyzable-command patterns that the permission checker now covers is broader than the four paths and two commands named in the release notes. Test against your own deny rules before declaring parity.

Mr. Technology Verdict

v2.1.268 is the operational + security follow-up v2.1.267 was not. Three secrets leaks, two deny-rule bypasses, a WebFetch hang, a five-release HTTP 400 regression on third-party endpoints, and three gateway safety improvements in one release is a meaningful security floor-raise without a marquee feature. For a developer running Claude Code in CI, against a proxy, or behind a Claude apps gateway, the closed leaks and the WebFetch deadline alone are worth the bump.

For a developer shipping a plugin or operating a marketplace, the secrets-leak fix is mandatory. For a developer running an unattended agent, the WebFetch deadline is mandatory. For an enterprise running a Claude apps gateway, the new managed settings and the passive warnings are mandatory.

Pin v2.1.268 in production. Rotate any token that may have leaked through the closed surfaces before you bump.

Recommended Action

Today

  • Pin your CI to v2.1.268. The WebFetch 5-minute deadline and the WIF jti reused fix alone are worth the upgrade for any CI fleet running unattended Claude Code.
  • Inventory your team's MCP configs for ${VAR} token placeholders. If you see one, confirm the resolved token did not previously appear in claude mcp list output or in MCP login errors; rotate if it did.
  • Inventory your plugin marketplace entries for git URLs with inline credentials. Rotate any token that may have been echoed in plugin install/update errors.
  • If you use Claude Code against OpenRouter, AWS Bedrock Marketplace, or any third-party Anthropic-compatible endpoint, upgrade from v2.1.265/v2.1.266/v2.1.267 directly to v2.1.268 to unblock the HTTP 400 regression.

This week

  • Re-test your deny/ask permission rules against symlinked paths (/etc, /tmp, /var, /bin on macOS, /bin on Linux) and against env -C/eval-wrapped commands. The closed bypasses mean rules that previously failed silently now apply.
  • For Claude apps gateway operators: set pricing: in gateway.yaml to align /cost and telemetry with the spend meter; set gatewayInternalNetworks to your org's public IPv4 block; verify access_control.allow_cidrs is non-empty and matches the intended reach.
  • Audit your self-hosted runners' disk usage under <base-dir>/_sessions/. If you want post-session cleanup, opt into --remove-session-state.

Skip if not in scope

  • If you don't use marketplaces, MCP ${VAR} configs, third-party Anthropic-compatible endpoints, or a Claude apps gateway, the security and gateway items don't affect you. The WebFetch deadline and operational fixes are still worth a routine upgrade.
  • If you only use Claude Code interactively from a terminal without CI, unattended agents, or proxy routing, none of these fixes change your day-to-day usage.

Sources

Article History

Originally published: 2026-09-11 14:08 UTC Last verified: 2026-09-11 14:09 UTC No corrections at this time. Correction (2026-09-11 18:13 Berlin): EQR flagged the article for missing the required ## What Actually Changed H2 (Charter v2 'Required article structure' item #2). The substantive content was present as 6 H3 subsections inside ## What Happened (Three secrets leaks / Two permission deny-rule bypasses / One 18-month-old WebFetch hang / One HTTP 400 regression since v2.1.265 / Three Claude apps gateway capabilities / One operational cleanup). Editorial fix: trimmed ## What Happened to the release event headline + summary paragraph and inserted a dedicated ## What Actually Changed H2 carrying the intro sentence + the 6 H3 subsections verbatim. Article body, verdict, recommended action, primary sources, and history block otherwise unchanged; this is a structural charter compliance fix, not a content correction.

Related Dispatches