Vulnerability · Published Oct 12, 2026 · Assigned by VulnCheck

CVE-2026-109561goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations

Medium 4.2

In plain English

A medium-severity incorrect authorization in goose from aaif-goose. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.2%top 90.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.

Affected products (as reported)

Vendor	Product	Versions
aaif-goose	goose	1.28.0 – before 1.44.0

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

References

GitHub Pull Request #10528 issue-tracking, patch
Patch Commit patch
Vulnerable code in permission_inspector.rs technical-description
goose v1.44.0 Release Notes release-notes
https://github.com/aaif-goose/goose product
VulnCheck Advisory: goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations third-party-advisory