CVE-2026-109561

4.2Medium

Published 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

4.2Medium

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: Required
Impact: Limited impact
Weakness: CWE-863

Impact

Attackers can bypass manual tool approval prompts via prompt injection to read or alter data using read-only annotated tools. This requires the user to interact with the attacker-controlled prompt and to have previously switched from Smart Approval to Manual Approval mode in the same session.

Root cause

The update_goose_mode function fails to clear persisted read-only annotations when switching approval modes, allowing PermissionInspector to run tools without prompting.

Affected systems

goose 1.28.0 before 1.44.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Fix & remediation

Upgrade goose to version 1.44.0 or later. As an interim workaround, restart the application session instead of switching modes in-place to avoid carrying over persisted annotations.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109561