CVE-2026-109561: goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations
goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by updategoosemode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gooseto a version that resolves this vulnerability.Fixed in 1.44.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Block Goose versions 1.28.0 through versions before 1.44.0 are exposed when they use a session that has previously entered Smart Approval mode and later select Manual Approval mode.
What must happen for the approval bypass to be exploited?
A tool must retain a readOnlyHint: true annotation from Smart Approval mode, and a prompt-injected call must invoke that tool after the user switches to Manual Approval mode. The affected tool can then execute without prompting the user.
Does Manual Approval mode alone prevent this behavior?
No. In affected versions, switching to Manual Approval mode does not clear persisted read-only annotations, so previously annotated tools may still run without approval.
How can I reduce exposure if I cannot update immediately?
Avoid using Smart Approval mode in sessions where Manual Approval is required, because the bypass depends on read-only annotations persisting after use of Smart Approval mode.