Goose: Exposure of shell history and secrets to LLM providers
Summary
When the terminal integration of Goose is enabled, the tool captures shell command history and sends it unfiltered to the configured Large Language Model (LLM) provider during queries. Credentials, API tokens or environment variables typed into the shell can therefore be disclosed to external service providers and to their logs. Exploitation requires that the feature is enabled and that a user takes action, and there is no inbound network service to attack.
Affected
Unknown. The CNA record lists Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 as affected by default. Exact affected package versions could not be verified.
Fixed in
Unknown. No fixed version is confirmed in the sources reviewed.
Workaround
- Check shell profiles for 'goose term init' with the flag '--dangerous-include-history' and remove it.
- Start a new terminal session or restart the shell after the change, so that old hooks are no longer active.
- Do not type secrets into a shell where Goose is active; use a secrets manager or credential helper instead.
- Rotate API tokens and passwords that may have been typed while the feature was enabled, and review the LLM provider's data retention terms.
Exploitation
- No known exploitation; not marked as known exploited in the reviewed sources.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact partial.
- No public proof of concept found.
Our recommendation
- Identify developer workstations and admin laptops where Goose terminal integration is enabled and disable the history option.
- Rotate any secrets that were entered in a shell while the feature was active.
- Check for the Red Hat advisory and install the fixed Goose version once it is confirmed.
- Assess with the data protection officer whether personal data or customer credentials were disclosed, considering the Swiss FADP.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Red Hat CVE page CVE-2026-111079 access.redhat.com
- Red Hat Bugzilla 2554025 bugzilla.redhat.com
- Goose terminal integration documentation goose-docs.ai
- Goose upstream PR 13051 (opt-in shell history) github.com
- Red Hat PR 71 (opt-in dangerous history flag) github.com
- VulDB entry 425247 vuldb.com
- HOL Guard CVE entry hol.org
- CVE threatint entry cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 3 Nov 2026, 00:36.
Original description (NVD)
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.