{"id":"CVE-2026-109561","revision":"5f322fa4100d4fda8e3e7a7dcdaa8270","records":[{"revision":"5f322fa4100d4fda8e3e7a7dcdaa8270","observedAt":"2026-10-26T18:35:30.824+00:00","statement":{"source":"cve-program","id":"CVE-2026-109561","aliases":[],"title":"goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations","description":"goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.","state":0,"publishedAt":"2026-10-12T20:55:15.574+00:00","modifiedAt":"2026-10-26T17:37:12.108+00:00","affected":[{"ecosystem":"Vendor product","name":"goose","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"aaif-goose\",\n                    \"product\": \"goose\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"1.28.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"1.44.0\"\n                        },\n                        {\n                            \"version\": \"1.44.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ],\n                    \"repo\": \"https://github.com/aaif-goose/goose\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.3,"severity":"LOW"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","score":4.2,"severity":"MEDIUM"}],"references":["https://github.com/aaif-goose/goose/pull/10528","https://github.com/aaif-goose/goose/commit/b0f4e2a0f1a5507aa0a0fbe73d0b5c77a3e86845","https://github.com/aaif-goose/goose/blob/v1.43.0/crates/goose/src/permission/permission_inspector.rs#L159","https://github.com/aaif-goose/goose/releases/tag/v1.44.0","https://github.com/aaif-goose/goose","https://www.vulncheck.com/advisories/goose-from-1.28.0-before-1.44.0-manual-approval-bypass-via-read-only-tool-annotations"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109561","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-109561","identifiers":["CVE-2026-109561"]},"retained":false,"historicalAffected":[]}],"coverage":[]}