Flaw in Goose Application Exposes Sensitive Commands to External Endpoints
CVE-2026-111079

7.4HIGH

Key Information:

Vendor

Red Hat
Status
Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 9
Vendor
CVE Published:
22 October 2026

What is CVE-2026-111079?

A vulnerability exists in the Goose application related to its terminal integration feature, which captures shell command history. When users enter sensitive data, such as API tokens and passwords, this information is sent unfiltered to configured Large Language Model (LLM) endpoints. This can lead to unauthorized disclosure of confidential credentials, as unredacted information may be exposed across trust boundaries. It poses a significant risk as it allows external service providers to potentially access sensitive user data inadvertently.

References

https://access.redhat.com/security/cve/CVE-2026-111079
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2554025
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
7.4
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

This issue was discovered by Manuel Moran (Red Hat), Rodolfo Olivieri (Red Hat), and Theofanis Petkos (Red Hat / GitHub https://github.com/thepetk).
.