CVE-2026-109561: goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations

Q: Who is exposed to this issue?

Users of Block Goose versions 1.28.0 through versions before 1.44.0 are exposed when they use a session that has previously entered Smart Approval mode and later select Manual Approval mode.

Q: What must happen for the approval bypass to be exploited?

A tool must retain a readOnlyHint: true annotation from Smart Approval mode, and a prompt-injected call must invoke that tool after the user switches to Manual Approval mode. The affected tool can then execute without prompting the user.

Q: Does Manual Approval mode alone prevent this behavior?

No. In affected versions, switching to Manual Approval mode does not clear persisted read-only annotations, so previously annotated tools may still run without approval.

Q: How can I reduce exposure if I cannot update immediately?

Avoid using Smart Approval mode in sessions where Manual Approval is required, because the bypass depends on read-only annotations persisting after use of Smart Approval mode.

Published Oct 12, 2026

Updated

goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by updategoosemode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.

Affected Software

1 affected component

Block Goose>=1.28.0<1.44.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade goose to a version that resolves this vulnerability.
Fixed in 1.44.0

Event History

Oct 12, 2026

CVE Published

via MITRE·08:55 PM

Data Sourced

via MITRE·08:55 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Users of Block Goose versions 1.28.0 through versions before 1.44.0 are exposed when they use a session that has previously entered Smart Approval mode and later select Manual Approval mode.

What must happen for the approval bypass to be exploited?

A tool must retain a readOnlyHint: true annotation from Smart Approval mode, and a prompt-injected call must invoke that tool after the user switches to Manual Approval mode. The affected tool can then execute without prompting the user.

Does Manual Approval mode alone prevent this behavior?

No. In affected versions, switching to Manual Approval mode does not clear persisted read-only annotations, so previously annotated tools may still run without approval.

How can I reduce exposure if I cannot update immediately?

Avoid using Smart Approval mode in sessions where Manual Approval is required, because the bypass depends on read-only annotations persisting after use of Smart Approval mode.

CVE-2026-109561: goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What must happen for the approval bypass to be exploited?

Does Manual Approval mode alone prevent this behavior?

How can I reduce exposure if I cannot update immediately?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What must happen for the approval bypass to be exploited?

Does Manual Approval mode alone prevent this behavior?

How can I reduce exposure if I cannot update immediately?