ByteStash API Keys Survived the Account Deactivation They Should Have Lost
ByteStash is a code and snippet manager with an API and MCP integration. CVE-2026-126658 affects versions 1.5.10 before 1.6.2. The issue is insufficient session expiration: the API-key validation path does not check whether the owning account is still active.
That difference matters during offboarding. An administrator may disable or deactivate the user profile and assume access has stopped. If a stored API key remains valid, the former user, a compromised client or an automation that holds the key can continue reading or modifying snippets.
The public description states that key holders can keep access after account deactivation. It does not claim that every key survives every administrative action. Verify the exact account and key lifecycle in the affected build.
Deactivation must cover every credential
A user account can have a password, browser session, personal access token and API key. Each is a separate authentication path. A correct offboarding workflow disables the account and revokes or expires all credentials that can operate independently.
API keys often live in CI jobs, note-taking tools, editor extensions and MCP clients. The owner may not know every place a key was copied. That makes server-side revocation the reliable control.
ByteStash content can include internal code fragments, connection examples, incident notes and operational procedures. Access after deactivation can expose information that is not obvious from the account profile.
Fixed behavior and deployment check
ByteStash 1.6.2 is the fixed version. Upgrade and confirm that a deactivated account's existing API key is rejected. Test both direct API calls and the MCP path if that integration is enabled.
Review the deployment's API-key inventory for owners who are no longer active. Remove keys that are not needed, rotate those used by shared automation and record the credential owner.
If an immediate upgrade is not possible, restrict API access to known networks and disable MCP or automation endpoints for accounts that cannot be verified. This is a temporary control; it does not repair the account-status check.
Offboarding evidence
Build an offboarding checklist that records the account status, key revocation, session invalidation and automation ownership. Keep the evidence in the identity record rather than relying on a verbal handoff.
Review logs for API use after account deactivation, especially at unusual times or from new addresses. Check for recently created, modified or exported snippets. Preserve the relevant request metadata and the account's effective status.
If a deactivated key was used, treat the snippets it could reach as potentially exposed. Rotate any credentials or connection strings stored in those snippets. Check whether the key could create new snippets, change sharing settings or invoke MCP actions.
A lifecycle problem
CVE-2026-126658 is narrow in code but broad in process. It shows that account disablement and credential revocation are separate operations. Security teams should verify both, and API-key systems should fail closed when the owner is no longer active.
Top comments (0)