CVE-2026-111079

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.

Red Hat Product Security has rated this vulnerability as having an Important severity impact because unredacted credentials and environment secrets can be transmitted across trust boundaries to external service endpoints without sanitization. While triggering the issue requires user interaction to initialize the terminal integration subshell and execute assistant queries, the potential disclosure of persistent API tokens and credentials carries significant confidentiality impact. Standard non-interactive command-line usage and sessions operating without the terminal integration hook are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.