CVE-2026-111079: Exposure of Sensitive System Information to an Unauthorized Control Sphere in Red Hat Red Hat Enterprise Linux 10

This vulnerability arises from Goose's terminal integration feature in Red Hat Enterprise Linux 10, which captures and transmits shell command history verbatim to LLM provider endpoints without sanitization. If users enter sensitive data in the terminal, this data is sent across trust boundaries unredacted, leading to potential exposure of confidential credentials to external services and logs. The CVSS 3.1 score is 7.4 (High), indicating network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and high confidentiality impact with no integrity or availability impact.

The vulnerability can lead to the disclosure of sensitive system information, including API tokens, passwords, and environment variables containing secrets. This exposure occurs because sensitive command history is transmitted unredacted to external LLM service endpoints and may also be recorded in logs, potentially compromising confidentiality of credentials and secrets.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2026-111079 for current remediation guidance. Until a fix is available, users should consider disabling the terminal integration feature in Goose or avoid entering sensitive information in the terminal when this feature is enabled to prevent leakage of sensitive data.