CVE-2026-109561
mediumgoose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because p…
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/aaif-goose/goose disclosure@vulncheck.com
- https://github.com/aaif-goose/goose/blob/v1.43.0/crates/goose/src/permission/permission_in... disclosure@vulncheck.com
- https://github.com/aaif-goose/goose/commit/b0f4e2a0f1a5507aa0a0fbe73d0b5c77a3e86845 disclosure@vulncheck.com
- https://github.com/aaif-goose/goose/pull/10528 disclosure@vulncheck.com
- https://github.com/aaif-goose/goose/releases/tag/v1.44.0 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/goose-from-1.28.0-before-1.44.0-manual-approval-bypas... disclosure@vulncheck.com