---
title: Claude Code 2.1.321 fixes MCP OAuth sending refresh tokens to another host on redirect, plus three sandbox and permission-prompt bypasses | ctxsec
url: https://ctxsec.com/items/claude-code-2-1-321-mcp-oauth-refresh-token-redirect-leak-sandbox-permission-fixes
description: "Anthropic's Nov 9 Claude Code release notes list a fix for MCP OAuth requests that sent secrets such as refresh tokens to another host when a server redirected them. The same release fixes a read-only Bash command running outside the sandbox without a prompt, permission checks judging a file write from the wrong folder, and deny rules not applying to files written by cp or mv into a directory. Anthropic has not published an advisory, so the conditions and impact beyond the changelog lines are unknown."
status: "official (Claude Code CHANGELOG, version 2.1.321, published to npm Nov 9, 2026 19:02 UTC); no advisory or CVE for these fixes at publication"
published: 2026-11-10
---

> Anthropic's Nov 9 Claude Code release notes list a fix for MCP OAuth requests that sent secrets such as refresh tokens to another host when a server redirected them. The same release fixes a read-only Bash command running outside the sandbox without a prompt, permission checks judging a file write from the wrong folder, and deny rules not applying to files written by cp or mv into a directory. Anthropic has not published an advisory, so the conditions and impact beyond the changelog lines are unknown.

[← Context & Harness Attacks](/context) · [markdown](/items/claude-code-2-1-321-mcp-oauth-refresh-token-redirect-leak-sandbox-permission-fixes.md)

official (Claude Code CHANGELOG, version 2.1.321, published to npm Nov 9, 2026 19:02 UTC); no advisory or CVE for these fixes at publication

2026-11-10

### Claude Code 2.1.321 fixes MCP OAuth sending refresh tokens to another host on redirect, plus three sandbox and permission-prompt bypasses

- **Update:** run `claude --version`; you want 2.1.321 or later (2.1.322 shipped Nov 10). Auto-update users get it automatically.
- **Why the OAuth fix matters:** a remote MCP server, or anything able to redirect its OAuth endpoint, could have received a refresh token meant for another host, and refresh tokens usually outlive sessions. See the tip for what to revoke.
- **Separately:** the Edit-tool TOCTOU sandbox escape CVE-2026-88968 (GHSA-5xjx-9qx6-jcrv, CVSS 4.0 7.7, macOS) circulating today was fixed in 2.1.251 in August; its CVE record was published Nov 3.

Sources: [Claude Code CHANGELOG (2.1.321)](https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md) · [npm: @anthropic-ai/claude-code](https://www.npmjs.com/package/@anthropic-ai/claude-code) · [GHSA-5xjx-9qx6-jcrv / CVE-2026-88968](https://github.com/anthropics/claude-code/security/advisories/GHSA-5xjx-9qx6-jcrv)