CVE-2026-109561 aaif-goose CVE debrief

Who should care

Defenders responsible for managing goose instances, particularly those using Manual Approval mode, should be aware of this vulnerability and take necessary actions to mitigate it. This includes verifying and updating goose instances, reviewing approval mode configurations, and monitoring for suspicious activity. Additionally, operators and security teams should review the vulnerability's impact on their platforms and prioritize remediation efforts. Those

Why it matters

A low-severity vulnerability in goose allows tools to run without user approval in Manual Approval mode, potentially leading to unauthorized tool execution. Defenders should verify and update goose instances, review approval mode configurations, and monitor for suspicious activity.

• Defenders need to verify the approval mode configuration to prevent unauthorized tool execution.
• Instances running goose versions from 1.28.0 before 1.44.0 are potentially vulnerable to this bypass.
• Updating to version 1.44.0 or later is necessary to fix the vulnerability.
• Monitoring for suspicious activity related to tool execution in Manual Approval mode is recommended.

Technical summary

The vulnerability exists in goose versions from 1.28.0 before 1.44.0 due to improper handling of read-only tool annotations. This allows tools to run without user approval in Manual Approval mode, potentially leading to unauthorized tool execution. The issue arises after a session uses Smart Approval mode, enabling prompt-injected calls to tools annotated with readOnlyHint: true to execute without prompting, thereby bypassing the user's selected approval mode. Defenders should prioritize verifying the approval mode configuration and ensuring that all goose instances are updated to version 1.44.0 or later to mitigate this vulnerability. Affected product deployments should be identified, and owners assigned for

Defensive priority

Defenders should prioritize verifying the approval mode configuration and ensuring that all goose instances are updated to version 1.44.0 or later to mitigate this vulnerability.

Recommended defensive actions

• Verify and update goose instances to version 1.44.0 or later
• Review and adjust approval mode configurations to prevent unauthorized tool execution
• Monitor for any suspicious activity related to tool execution in Manual Approval mode
• Perform vulnerability scanning to identify potentially exposed instances
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets to ensure vulnerability closure
• Review asset inventory to identify and prioritize remediation efforts

Evidence notes

The vulnerability is attributed to the improper handling of read-only tool annotations in goose. The CVE Program record and NVD vulnerability detail provide official information on this issue. Supplemental sources include issue-tracking, patch, technical-description, release-notes, and product information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.