goose EUVD-2026-97884

Exploitation requires a specific stateful sequence, not a default-config remote attack: (1) the goose session must have previously operated in Smart Approval mode, which applies/persists tool annotations; (2) the mode is then changed via update_goose_mode to Manual Approval, which fails to clear those persisted read-only annotations; and (3) the attacker must achieve prompt injection to invoke tools annotated readOnlyHint:true, which PermissionInspector::inspect then executes without prompting. Limiting factors: only tools carrying a read-only annotation are affected, the victim must have used Smart Approval earlier in the session, and the attacker needs a prompt-injection channel - there is no direct unauthenticated code path against a fresh default Manual Approval session. Affected versions are goose 1.28.0 up to (not including) 1.44.0.

This is a genuine but low-severity authorization logic flaw, and the signals are internally consistent rather than conflicting. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:N) scores only 2.3: although network-reachable and requiring no privileges, exploitation carries a present attack requirement (AT:P) - the session must have previously entered Smart Approval mode - plus passive user interaction (UI:P), and impact is limited to low confidentiality/integrity with no availability effect. No EPSS probability was supplied, the CVE is NOT in CISA KEV, and no public proof-of-concept was provided, so there is no public exploit identified at time of analysis. The practical danger is amplified by the accompanying fix showing that at least one powerful tool (execute_bash) had been mislabeled with readOnlyHint:true, meaning the 'read-only' set that bypasses prompting could include non-trivial tools; however, exploitation still depends on an attacker-controlled prompt-injection path and a prior Smart Approval session, which keeps real-world risk low. Net: patch on a normal cadence - this is a defense-in-depth/approval-integrity bug in a developer AI agent, not an urgent widespread-exploitation priority.

A user runs goose, uses Smart Approval mode (which persists read-only tool annotations), then switches to Manual Approval mode expecting every tool call to be prompted. An attacker who can inject a prompt - e.g. via untrusted file contents, a web page, or MCP data the agent ingests - issues calls to tools annotated readOnlyHint:true, which execute silently without the Manual Approval prompt. No public exploit code is known, but the bug is reachable over the network via prompt injection and requires no special attacker privileges.