CVE-2026-109561

goose from 1.28.0 before 1.44.0 contains an authorization bypass vulnerability that allows tools to run without user approval in Manual Approval mode because persisted read-only annotations are never cleared by update_goose_mode. After a session uses Smart Approval mode, prompt-injected calls to tools annotated readOnlyHint: true execute without prompting, bypassing the user's selected approval mode in PermissionInspector::inspect.

The organization may be exposed to unauthorized tool execution by compromised or prompt-injected agents, leading to actions without the operator's knowledge or consent. This can result in data modification or execution of dangerous operations in production environments.

Upgrade goose to version 1.44.0 or later, and until then avoid Smart Approval mode and verify that read-only annotations are properly cleared when switching modes. Consider restricting agent permissions and monitoring for unusual tool invocations.