CVE-2026-108861
Received Received - Intake

Information Disclosure in Odoo MCP via execute_method Tool

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: VulnCheck

Description
Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their values unredacted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-108861
EUVD
EUVD-2026-97012

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
erpipe-org Odoo MCP 1.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Odoo MCP versions 1.0.0 through 1.3.2 have an information disclosure vulnerability. The execute_method tool can be misused by MCP clients to bypass field-level access controls. This allows attackers or prompt-injected agents to read restricted fields by calling read or search_read through execute_method, exposing unredacted data.

Detection Guidance

To detect this vulnerability, check if your Odoo MCP server is running versions 1.0.0 through 1.3.2. Verify if the execute_method tool is enabled and test if it allows bypassing field-level ACLs by attempting to read restricted fields. Monitor logs for unauthorized read operations via execute_method.

Impact Analysis

This vulnerability could allow unauthorized access to sensitive data stored in Odoo MCP systems. Attackers might retrieve confidential information such as user details, financial records, or other restricted fields without proper permissions.

Compliance Impact

This vulnerability could lead to non-compliance with data protection regulations like GDPR or HIPAA by exposing sensitive personal or health information. Organizations may face legal penalties, reputational damage, and loss of trust due to unauthorized data access.

Mitigation Strategies

Upgrade Odoo MCP to a version beyond 1.3.2 to address the information disclosure vulnerability. Review and restrict access to the execute_method tool to prevent unauthorized field-level ACL bypasses.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-108861. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart