{"id":"CVE-2026-111079","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-111079","generatedAt":"2026-10-27T22:47:38.789Z","title":"This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.","description":"A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.","published":"2026-10-22T11:17:15.000Z","lastModified":"2026-10-23T15:17:24.000Z","status":"Awaiting Analysis","sourceIdentifier":"secalert@redhat.com","cvss":{"version":"3.1","score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"},"cwe":["CWE-497"],"affected":[],"epss":{"score":0.00301,"percentile":0.22676,"date":"2026-10-26","history":[{"date":"2026-10-23","score":0.00229,"percentile":0.1297}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.30%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-22T11:17:15.000Z","detail":{"score":"7.4","severity":"HIGH","publishedAt":"2026-10-22T11:17:15.460Z"},"summary":"New CVE, high severity (CVSS 7.4)."}],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-111079","source":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2554025","source":"secalert@redhat.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-111079","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}