Red Hat Security Advisory: goose security update

The Red Hat security advisory RHSA-2026:80765 addresses four vulnerabilities in the goose component of Red Hat Enterprise Linux 10. CVE-2026-72718 allows arbitrary command execution through malicious Git configuration in the 'goose review' command. CVE-2026-63127 involves token impersonation due to missing OAuth resource field validation in the RMCP protocol. CVE-2026-63128 is a denial of service vulnerability caused by unauthenticated session table leakage. CVE-2026-93599 is another denial of service vulnerability triggered by a crafted Certificate Revocation List in rustls-webpki. The advisory provides a fix by updating goose to version 1.45.0-1.el10_2 across supported architectures. Users are advised to apply this update after ensuring all previous errata are applied.

The vulnerabilities collectively allow an attacker to execute arbitrary commands, impersonate tokens, and cause denial of service conditions on affected systems. These issues could lead to unauthorized access and service disruption if exploited. The advisory classifies the severity as important, indicating a high impact on confidentiality, integrity, and availability of the affected systems.

Red Hat has released an official security update for goose, updating it to version 1.45.0-1.el10_2, which addresses all identified vulnerabilities. Users should apply this update promptly after ensuring all previously released errata relevant to their system have been applied. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated beyond applying the official patch.