CVE-2026-108861: Odoo MCP Information Disclosure Vulnerability

CVE-2026-108861 Overview

CVE-2026-108861 is an information disclosure vulnerability affecting Odoo MCP versions 1.0.0 through 1.3.2. The flaw allows Model Context Protocol (MCP) clients to bypass field-level Access Control Lists (ACLs) by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method, naming denied fields and receiving their values unredacted. The weakness is tracked as CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Authenticated MCP clients, including prompt-injected AI agents, can retrieve ERP field values that the field-level ACL is designed to withhold.

Affected Products

Odoo MCP (erpipe-org/mcp-odoo) version 1.0.0
Odoo MCP versions 1.1.x through 1.3.1
Odoo MCP version 1.3.2

Discovery Timeline

2026-10-11 - CVE-2026-108861 published to the National Vulnerability Database (NVD)
2026-10-16 - Last updated in the NVD database

Technical Details for CVE-2026-108861

Vulnerability Analysis

Odoo MCP exposes a server that lets MCP clients interact with an Odoo Enterprise Resource Planning (ERP) backend. The server implements a field-level ACL intended to redact sensitive attributes before returning records to clients. The ACL is enforced on the higher-level read helpers but is not applied to the generic execute_method tool. As a result, a client calling execute_method with the target model and either read or search_read as the method bypasses the redaction layer. The denied field names are passed directly through to the underlying ORM and returned to the caller with their original values intact. The relevant handler is implemented in src/odoo_mcp/tools_write.py lines 709-806.

Root Cause

The field-level ACL is enforced in dedicated read tools, not inside execute_method. Because execute_method is a generic Remote Procedure Call (RPC) passthrough, it accepts arbitrary method names and arguments. No validation strips disallowed fields from the fields argument before dispatch. The ACL therefore protects only the sanctioned code path and does not act as a true policy boundary.

Attack Vector

Exploitation requires an authenticated MCP session with at least low privileges. An attacker invokes the execute_method tool, supplies the target model (for example, res.partner or hr.employee), selects read or search_read as the method, and lists ACL-denied fields in the fields parameter. The server returns the unredacted values. In agentic deployments, a prompt-injection payload embedded in untrusted content can direct the agent to perform the same call on behalf of the attacker. See the HackMD technical analysis and the VulnCheck advisory for additional detail.

Detection Methods for CVE-2026-108861

Indicators of Compromise

MCP audit entries showing execute_method invocations whose method argument is read or search_read.
Requests to execute_method whose fields parameter enumerates attributes present on the server's field-level denylist.
Repeated low-privileged client calls iterating across models such as res.partner, res.users, hr.employee, or account.move.

Detection Strategies

Instrument the MCP server to log every execute_method call with the model, method, and fields list, then compare the field list against the ACL denylist.
Alert when agent-driven sessions call execute_method with read/search_read instead of the sanctioned read tools.
Correlate MCP tool-call logs with upstream prompt content to identify prompt-injection sequences that pivot into direct method invocation.

Monitoring Recommendations

Forward MCP server logs and Odoo RPC audit trails to a centralized analytics platform for retention and query.
Baseline normal execute_method usage per client and alert on sudden increases in denied-field access patterns.
Review AI agent transcripts and tool-call traces for untrusted inputs that steer the agent toward ERP data extraction.

How to Mitigate CVE-2026-108861

Immediate Actions Required

Upgrade Odoo MCP to a fixed release above 1.3.2 once published by the maintainers; track the erpipe-org/mcp-odoo repository for the patched version.
Restrict MCP client credentials to the minimum Odoo roles required and revoke tokens issued to untrusted agents.
Audit historical MCP logs for execute_method calls that referenced ACL-denied fields and treat matches as potential data exposure.

Patch Information

At the time of publication, the vulnerable code remains present through version 1.3.2 as referenced in the upstream source. Operators should monitor the project repository and the VulnCheck advisory for a fixed release and apply it as soon as it becomes available.

Workarounds

Disable or remove the execute_method tool from the MCP server configuration until a patched release is deployed.
Wrap execute_method with a server-side guard that rejects read and search_read methods or filters out ACL-denied field names before dispatch.
Place the MCP server behind a network boundary that only trusted clients can reach, and require strong authentication for every session.
Treat all content supplied to AI agents from untrusted sources as potentially hostile and constrain agent tool permissions accordingly.

bash

# Example: remove execute_method from the exposed MCP tool set
# (illustrative configuration snippet — adapt to your deployment)
export ODOO_MCP_DISABLED_TOOLS="execute_method"