# goose: terminal integration sends shell history to the model provider

> CVE-2026-111079 carries tokens and passwords typed in a shell into every later request goose makes to its model provider.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Red Hat
- **Disclosed:** 2026-10-22
- **CVE:** CVE-2026-111079
- **CVSS:** 7.4
- **Affects:** goose
- **Research by:** Manuel Moran, Rodolfo Olivieri, [Theofanis Petkos](https://github.com/thepetk)
- **Primary source:** https://access.redhat.com/security/cve/CVE-2026-111079
- **Page:** https://theinjection.dev/items/goose-term-shell-history-llm-leak/

goose's opt-in terminal integration logs every command typed in the shell and sends it unsanitized to the configured model provider, so tokens and passwords leave the machine. Red Hat assigned CVE-2026-111079 and lists no fix.

## What happened

Red Hat published CVE-2026-111079 on October 22, 2026, after three of its own engineers reported a data leak in goose, the open-source AI agent now hosted by the Agentic AI Foundation at the Linux Foundation. The report was filed in Red Hat's bug tracker on October 16 and is still open. Red Hat rates the flaw Important.

## How it works

The terminal integration installs a shell preexec hook that logs each command the user types. On the next call to the agent, every command recorded since the last assistant response is sent to the configured model provider endpoint with no sanitization. Secrets passed as command arguments or set with export travel with that history, and the whole batch goes out even when the question asked has nothing to do with it.

## Who is affected

Only goose sessions with the terminal integration enabled are exposed, because the leak depends on the shell preexec hook that integration installs. Red Hat states that ordinary non-interactive command-line use, and sessions without that hook, are not affected. The affected release range is listed below.

## What to do

Disable the terminal integration and remove its shell preexec hook, then rotate every token, password and exported variable typed in a terminal while the hook was active. Treat the provider's logs as a place those secrets may now sit, and check the bug report below before assuming a later release closes it.

## Quick facts

- **Affected:** goose v1.16.0 through v1.54.0, per Red Hat
- **Component:** Terminal integration shell preexec hook, introduced in commit 5f50198
- **CVE:** CVE-2026-111079
- **CVSS:** 7.4, published by Red Hat as the assigning CNA
- **Found by:** Manuel Moran, Rodolfo Olivieri and Theofanis Petkos, Red Hat
- **Disclosed:** Reported 2026-10-16, CVE published 2026-10-22
- **Status:** No fix identified; Red Hat bug report still open

## Questions

### Is there a fix for CVE-2026-111079 in goose?

No fix is identified for CVE-2026-111079. Red Hat's bug report, filed on October 16, 2026, remains open, and the release notes for goose v1.55.0 and v1.56.0 do not mention the terminal integration, shell history or this CVE. Defenders should disable the terminal integration rather than wait for a version number to upgrade to.

### Which goose versions does Red Hat list as affected?

Red Hat's report lists goose releases v1.16.0 through v1.54.0, and traces the behavior to commit 5f50198, which introduced the terminal integration. Versions released after that range, v1.55.0 and v1.56.0, fall outside what the report covers, and no release note for either states that shell history handling changed.

### Does CVE-2026-111079 affect goose users who never enabled terminal integration?

Users who never enabled the terminal integration are not exposed. Red Hat states that ordinary non-interactive command-line use, and sessions without the shell preexec hook installed, are unaffected. The leak depends on that hook recording each typed command, so that goose can send the accumulated history to the model provider on a later request.

## Sources

1. [Red Hat Advisory](https://access.redhat.com/security/cve/CVE-2026-111079)
2. [Red Hat Bug Report](https://bugzilla.redhat.com/show_bug.cgi?id=2554025)
3. [goose Releases](https://github.com/aaif-goose/goose/releases)