Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-109561— goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations

Quick assessment

Affected
aaif-goose goose
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Goose 版本在 1.28.0（不含）至 1.44.0（不含）之间存在一个授权绕过漏洞，导致在“手动审批”（Manual Approval）模式下，工具可以在未经用户批准的情况下执行。该漏洞的原因是 函数从未清除持久化的只读注解。一旦会话曾经使用过“智能审批”（Smart Approval）模式，后续针对标注为 的工具所发起的提示注入（prompt-injected）调用将无需进行用户提示即可执行，从而绕过了 PermissionInspector::inspect 中用户所选的审批模式。

CVSS 4.2 · Medium EPSS 0.19% · P8

Affected Version Matrix 2

VendorProduct Version RangeStatus
aaif-goose goose 1.28.0< 1.44.0 affected
1.44.0 unaffected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-109561

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations
Source: CVE Program / CVE List V5
Vulnerability Description
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
aaif-goose goose 1.28.0 ~ 1.44.0 -

II. Public POCs for CVE-2026-109561

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-109561

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-109561 (3)

Vendor Advisories for CVE-2026-109561 (1)

Vendor Pages for CVE-2026-109561 (1)

Other References for CVE-2026-109561 (1)

IV. Related Vulnerabilities

Same product: goose
Same vendor: aaif-goose
Same weakness: CWE-863

V. Comments for CVE-2026-109561

No comments yet

Leave a comment