Authorization Bypass in Goose Affected by Read-Only Tool Annotations
CVE-2026-109561

2.3LOW

Key Information:

Vendor

Aaif-goose

Status
Goose
Vendor
CVE Published:
12 October 2026

What is CVE-2026-109561?

The Goose application versions from 1.28.0 to 1.43.0 contain an authorization bypass vulnerability. This issue arises when tools operate in Manual Approval mode, enabling them to execute without the user's consent. The root cause is linked to the persisted read-only annotations which are not cleared by the update_goose_mode function. Consequently, if a session utilizes Smart Approval mode, malicious prompt-injected calls to tools tagged with readOnlyHint: true bypass the necessary prompts, executing without the user’s established permissions.

Affected Version(s)

goose 1.28.0 < 1.44.0

goose 1.44.0

References

https://github.com/aaif-goose/goose/pull/10528
issue-trackingpatch
https://github.com/aaif-goose/goose/commit/b0f4e2a0f1a550...
patch
https://github.com/aaif-goose/goose/blob/v1.43.0/crates/g...
technical-description

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Akıner Kısa
Project Loupe
.