What is CVE-2026-111079?

CVE-2026-111079 is a high-severity vulnerability in Red Hat Enterprise Linux 10, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 7.4/10. Published 2026-10-22.

How severe is CVE-2026-111079?

High severity. CVSS v3 base score is 7.4 out of 10.

Vulnerability in Red Hat Enterprise Linux 10

CVE-2026-111079

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.

Published 2026-10-22 · last modified 2026-10-22.

CVSS v3 metric

CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

CWE-497 — Exposure of Sensitive System Information to an Unauthorized Control Sphere

References

access.redhat.com/security/cve/CVE-2026-111079 (vdb-entry)
bugzilla.redhat.com/show_bug.cgi (issue-tracking)

Frequently asked questions

What is CVE-2026-111079?: CVE-2026-111079 is a high-severity vulnerability in Red Hat Enterprise Linux 10, classified under Exposure of Sensitive System Information to an Unauthorized Control Sphere. CVSS score: 7.4/10. Published 2026-10-22.
How severe is CVE-2026-111079?: High severity. CVSS v3 base score is 7.4 out of 10.