Description
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.
Published: 2026-10-12
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Authorization Bypass via Manual Approval Mode
Action: Patch
AI Analysis

Impact

The vulnerability in Goose (aaif-goose:goose) is an authorization bypass that allows tools annotated with readOnlyHint to run without user confirmation when the approval mode is switched to Manual. This flaw (CWE-270) occurs because persisted read‑only annotations are never cleared by update_goose_mode, and the permission inspection mechanism (CWE-863) fails to enforce the Manual Approval safeguard.

Affected Systems

Versions of Goose from 1.28.0 up to, but not including, 1.44.0 are impacted. An installation is affected if it has previously used Smart Approval and retains persisted readOnlyHint annotations before switching to Manual Approval.

Risk and Exploitability

The CVSS score of 2.3 indicates low severity, and the EPSS score is not available. The vulnerability is not listed in CISA KEV. Exploitation requires that the user has enabled Smart Approval and then switched back to Manual Approval; an attacker can then trigger tool execution without user consent. The flaw does not enable arbitrary code execution beyond invoking the permitted tools, but it undermines the Manual Approval model.

Generated by OpenCVE AI on October 13, 2026 at 02:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Goose to version 1.44.0 or later, which clears persisted read‑only annotations when approval mode changes.
  • If an upgrade is not possible, delete or reset all persisted readOnlyHint annotations before switching to Manual Approval.
  • Review automated pipelines that run in Smart Approval mode and reconfigure them to require explicit user approval in Manual Approval; validate that tool calls prompt the user after the mode switch.

Generated by OpenCVE AI on October 13, 2026 at 02:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-270
References
Metrics threat_severity

None

 threat_severity

Moderate

Mon, 12 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
First Time appeared Aaif-goose
Aaif-goose goose
Vendors & Products Aaif-goose
Aaif-goose goose

Mon, 12 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.
Title goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations
Weaknesses CWE-863
References
Metrics cvssV3_1

{'score': 4.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Aaif-goose Goose
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-26T17:37:12.108Z

Reserved: 2026-10-12T19:27:51.947Z

Link: CVE-2026-109561

cve-icon Vulnrichment

Updated: 2026-10-26T17:36:12.470Z

cve-icon NVD

Status : Deferred

Published: 2026-10-12T21:17:12.403

Modified: 2026-10-26T18:17:34.430

Link: CVE-2026-109561

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-12T20:55:15Z

Links: CVE-2026-109561 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T03:00:11Z

Weaknesses
  • CWE-270

    Privilege Context Switching Error

  • CWE-863

    Incorrect Authorization