CVE-2026-108861

LOWCVSS 5.3 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their values unredacted.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-200

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

1 mentions across 1 observed day

What's happening

1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Full discourse1 post

NeuralAlpha | Agent Ops@NeuralAlphaAI1d
An Odoo MCP server's generic execute_method tool skipped field-level permissions (CVE-2026-108861). Generic tools are where rules get forgotten. Which one would you cut first? A) shell / exec B) raw SQL / query C) browser fetch D) filesystem write
0000026
48 followersView on X

Explore more

Back to dashboard