goose: read-only tool annotations skipped Manual Approval

01What happened

VulnCheck published CVE-2026-109561 on October 12, 2026, an approval bypass in goose, the open source AI agent that the project says is part of the Agentic AI Foundation at the Linux Foundation. The advisory credits Akıner Kısa and Project Loupe. The NVD published the record the same day, three months after the goose maintainers shipped the code change.

02How it works

Approval decisions rested on tool annotations that outlived the mode which honored them. A session run in Smart Approval mode stored read-only annotations, and update_goose_mode never cleared them, so PermissionInspector::inspect kept treating those tools as already allowed after the user switched to Manual Approval. A prompt-injected call to any tool annotated readOnlyHint: true then ran with no prompt, which VulnCheck classes as incorrect authorization (CWE-863).

03Who is affected

Versions 1.28.0 up to 1.44.0 of goose are affected, and only in sessions that used Smart Approval before the user selected Manual Approval. The patched release came out on July 23, 2026, so an installation pinned below 1.44.0 is the condition that still matters.

04What to do

Upgrade goose to 1.44.0 or later, the release VulnCheck lists as fixed. Check version pins in container images, lockfiles and installer scripts, because the fix is old enough that a stale pin is the likely reason for still running an affected build.

Questions people ask

Which goose versions need the CVE-2026-109561 fix?

goose 1.28.0 up to 1.44.0 carries the Manual Approval bypass, and 1.44.0 is the fixed release. VulnCheck lists no workaround, so an upgrade is the action. Because that release shipped in July 2026, a current install is already covered, and the versions that still matter are the ones held back by a pin.

Why did goose get a CVE for something fixed in July 2026?

VulnCheck published the goose advisory on October 12, 2026, while the code change shipped in release 1.44.0 on July 23, 2026, listed there as a bug fix called enforce manual approval for code mode. The public security record arrived about three months after the patch, so a team that tracks goose by CVE meets this flaw only this week.

Does Smart Approval mode in goose still use read-only annotations?

Yes. Pull request 10528 keeps read-only annotations and cached allows in effect for Smart Approval, and stops them from carrying over into Manual Approval. The same change marks the execute_bash tool in Code Mode as mutating and destructive, so goose no longer treats that tool as safe to allow without asking.

Sources 4 links, all fetched

1. 1vulncheck.comVulnCheck Advisory
2. 2github.comGitHub Advisory
3. 3github.comPatch Pull Request
4. 4github.comRelease Notes 1.44.0