CVE-2026-111079 Goose: goose: shell history and environment leak via terminal integration
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-111079?
CVE-2026-111079 is a high-severity vulnerability in Red Hat Enterprise Linux 10, published on 22 Oct 2026.
Official description
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.
Weakness: CWE-497
Which versions are affected by CVE-2026-111079?
Linux distribution packages (1)
goose openSUSE:Tumbleweed | All versions | 1.56.0-1.1 |
How do I fix CVE-2026-111079?
Upgrade to a fixed version.
Is CVE-2026-111079 being exploited?
There is no known exploitation of CVE-2026-111079 in the wild and no public exploit code.
Sources
Also known as GHSA-4537-c6fq-qchm, openSUSE-SU-2026:12288-1.