# goose: read-only tool annotations skipped Manual Approval

> goose kept read-only tool annotations from an earlier Smart Approval session, so Manual Approval mode stopped asking before those tools ran.

- **Severity:** Low: Minor, hard to exploit or mostly theoretical. Good to know.
- **Category:** Vulnerability
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-12
- **CVE:** CVE-2026-109561
- **CVSS:** 2.3
- **Affects:** goose
- **Research by:** Akıner Kısa, Project Loupe
- **Primary source:** https://www.vulncheck.com/advisories/goose-from-1.28.0-before-1.44.0-manual-approval-bypass-via-read-only-tool-annotations
- **Page:** https://theinjection.dev/items/goose-read-only-annotation-approval-bypass/

CVE-2026-109561 let prompt-injected calls to tools marked read-only run without a prompt in goose's Manual Approval mode, once a session had used Smart Approval. goose 1.28.0 to 1.43.x are affected, fixed in 1.44.0.

## What happened

VulnCheck published CVE-2026-109561 on October 12, 2026, an approval bypass in goose, the open source AI agent that the project says is part of the Agentic AI Foundation at the Linux Foundation. The advisory credits Akıner Kısa and Project Loupe. The NVD published the record the same day, three months after the goose maintainers shipped the code change.

## How it works

Approval decisions rested on tool annotations that outlived the mode which honored them. A session run in Smart Approval mode stored read-only annotations, and update_goose_mode never cleared them, so PermissionInspector::inspect kept treating those tools as already allowed after the user switched to Manual Approval. A prompt-injected call to any tool annotated readOnlyHint: true then ran with no prompt, which VulnCheck classes as incorrect authorization (CWE-863).

## Who is affected

Versions 1.28.0 up to 1.44.0 of goose are affected, and only in sessions that used Smart Approval before the user selected Manual Approval. The patched release came out on July 23, 2026, so an installation pinned below 1.44.0 is the condition that still matters.

## What to do

Upgrade goose to 1.44.0 or later, the release VulnCheck lists as fixed. Check version pins in container images, lockfiles and installer scripts, because the fix is old enough that a stale pin is the likely reason for still running an affected build.

## Quick facts

- **CVE:** CVE-2026-109561
- **CVSS 4.0:** 2.3, rated Low
- **Affected:** goose 1.28.0 up to 1.44.0
- **Fixed in:** 1.44.0, released July 23, 2026
- **Weakness:** CWE-863, annotations not cleared on a mode change
- **Found by:** Akıner Kısa and Project Loupe
- **Disclosed:** October 12, 2026 by VulnCheck, same day at the NVD

## Questions

### Which goose versions need the CVE-2026-109561 fix?

goose 1.28.0 up to 1.44.0 carries the Manual Approval bypass, and 1.44.0 is the fixed release. VulnCheck lists no workaround, so an upgrade is the action. Because that release shipped in July 2026, a current install is already covered, and the versions that still matter are the ones held back by a pin.

### Why did goose get a CVE for something fixed in July 2026?

VulnCheck published the goose advisory on October 12, 2026, while the code change shipped in release 1.44.0 on July 23, 2026, listed there as a bug fix called enforce manual approval for code mode. The public security record arrived about three months after the patch, so a team that tracks goose by CVE meets this flaw only this week.

### Does Smart Approval mode in goose still use read-only annotations?

Yes. Pull request 10528 keeps read-only annotations and cached allows in effect for Smart Approval, and stops them from carrying over into Manual Approval. The same change marks the execute_bash tool in Code Mode as mutating and destructive, so goose no longer treats that tool as safe to allow without asking.

## Sources

1. [VulnCheck Advisory](https://www.vulncheck.com/advisories/goose-from-1.28.0-before-1.44.0-manual-approval-bypass-via-read-only-tool-annotations)
2. [GitHub Advisory](https://github.com/advisories/GHSA-8h69-7j5q-pwfc)
3. [Patch Pull Request](https://github.com/aaif-goose/goose/pull/10528)
4. [Release Notes 1.44.0](https://github.com/aaif-goose/goose/releases/tag/v1.44.0)