CVE-2026-109561Published
goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations
Exact source revision recorded 26 Oct 2026 18:35:30 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-109561 · Microsoft / collected KEV context
cve-program · CVE-2026-109561
- https://github.com/aaif-goose/goose/pull/10528
- https://github.com/aaif-goose/goose/commit/b0f4e2a0f1a5507aa0a0fbe73d0b5c77a3e86845
- https://github.com/aaif-goose/goose/blob/v1.43.0/crates/goose/src/permission/permission_inspector.rs#L159
- https://github.com/aaif-goose/goose/releases/tag/v1.44.0
- https://github.com/aaif-goose/goose
- https://www.vulncheck.com/advisories/goose-from-1.28.0-before-1.44.0-manual-approval-bypass-via-read-only-tool-annotations
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.