{"id":"CVE-2026-111079","kind":"vulnerability","aliases":["CVE-2026-111079"],"related":[],"title":"Goose: terminal integration sends unredacted shell history to LLM providers","description":"A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.","summary":"When Goose's terminal integration is enabled, it captures shell command history and sends it verbatim to the configured LLM provider during queries. Any secrets typed in the terminal, such as API tokens, passwords or environment variables, can reach the external provider and its logs.","severity":"high","cvss":7.4,"epss":0.00229,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","developer-workstations","goose","llm"],"not_affected_if":["terminal-integration-disabled"],"how_to_check":"- Check whether the terminal integration feature in Goose is enabled in its configuration (unknown: the exact setting name is not in the sources).\n- Check the installed Goose version against the fixed release (unknown: the sources do not name a fixed version).","fix":"- Disable the Goose terminal integration feature until a fixed version is installed (unknown: the sources do not name a fixed version).\n- Rotate any API tokens or passwords that may have been typed into a terminal session while the feature was enabled.","status":"open","published_at":"2026-10-22T11:17:15+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:25:37+00:00","updated_at":"2026-10-25T03:25:37+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T03:25:37Z","model":"claude-haiku-5-5","output":{"fix":"- Disable the Goose terminal integration feature until a fixed version is installed (unknown: the sources do not name a fixed version).\n- Rotate any API tokens or passwords that may have been typed into a terminal session while the feature was enabled.","reach":"internet","title":"Goose: terminal integration sends unredacted shell history to LLM providers","impact":"medium","summary":"When Goose's terminal integration is enabled, it captures shell command history and sends it verbatim to the configured LLM provider during queries. Any secrets typed in the terminal, such as API tokens, passwords or environment variables, can reach the external provider and its logs.","category":"ai-tooling","nicknames":[],"who_cares":["goose","ai-tooling","llm","developer-workstations"],"confidence":0.6,"needs_auth":"no","worst_case":"Secrets typed in terminal sessions leak to external LLM providers and logs.","analyst_note":"Find the fixed Goose version and the terminal integration setting name at the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-111079) or the Goose project advisory.","how_to_check":"- Check whether the terminal integration feature in Goose is enabled in its configuration (unknown: the exact setting name is not in the sources).\n- Check the installed Goose version against the fixed release (unknown: the sources do not name a fixed version).","needs_analyst":true,"not_affected_if":["terminal-integration-disabled"],"who_is_affected":"Teams that run Goose with the terminal integration feature enabled and that type secrets into shell sessions being captured. The exposure path is the shell history sent to the configured LLM provider endpoint. Teams with the feature disabled, or that never enter secrets in captured terminals, are less exposed; the sources do not say which default applies.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":3390,"output_tokens":656,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111079':13A,16A '-2026':12A,15A 'across':129C 'ai':18B 'ai-tool':17B 'api':56B,113C 'applic':84C 'boundari':131C 'captur':33B,85C 'command':35B,87C 'confidenti':140C 'configur':43B,96C 'contain':119C 'credenti':141C 'cve':11A,14A 'data':110C 'develop':21B 'developer-workst':20B 'disclosur':138C 'enabl':31B,82C 'endpoint':102C 'enter':108C 'environ':60B,117C 'expos':139C 'extern':65B,143C 'featur':80C 'flaw':71C 'found':73C 'goos':1A,23B,26B,75C 'histori':7A,36B,88C 'inform':126C,137C 'integr':3A,29B,79C 'languag':98C 'larg':97C 'lead':134C 'llm':9A,24B,44B,100C 'log':69B,147C 'model':99C 'password':58B,115C 'provid':10A,45B,66B,101C,145C 'queri':47B,104C 'reach':63B 'sanit':94C 'secret':49B,120C 'send':4A,38B,90C 'sensit':109C,136C 'servic':144C 'shell':6A,34B,86C 'termin':2A,28B,53B,78C,123C 'token':57B,114C 'tool':19B 'transmit':128C 'trust':130C 'type':50B 'unredact':5A,125C 'user':107C 'variabl':61B,118C 'verbatim':40B,92C 'without':93C 'workstat':22B","nicknames":[],"mitigations":[],"who_affected":"Teams that run Goose with the terminal integration feature enabled and that type secrets into shell sessions being captured. The exposure path is the shell history sent to the configured LLM provider endpoint. Teams with the feature disabled, or that never enter secrets in captured terminals, are less exposed; the sources do not say which default applies.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111079","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111079","severity":null,"published_at":"2026-10-22T11:17:15+00:00","modified_at":"2026-10-23T15:17:23+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-111079","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-111079","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}