CVE-2026-108861 in MCP
Summary
by MITRE • 10/11/2026
Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their values unredacted.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The Odoo Model Context Protocol (MCP) implementation, specifically in versions 1.0.0 through 1.3.2, suffers from a critical information disclosure vulnerability rooted in the improper enforcement of access control lists at the field level. This flaw arises because the execute_method tool within the MCP interface does not adequately validate whether an invoking client possesses the necessary permissions to access specific data fields before executing database queries. Consequently, this architectural oversight allows malicious actors or prompt-injected autonomous agents to bypass standard security boundaries that are typically enforced by the Odoo application layer. The vulnerability effectively neutralizes field-level Access Control Lists (ACLs), which are designed to restrict visibility of sensitive information based on user roles and group memberships.
From a technical perspective, the exploitation mechanism involves invoking the execute_method tool with specific parameters targeting read or search_read operations. By explicitly naming fields that should be restricted by ACL rules, attackers can retrieve unredacted values for those fields directly from the database backend. This bypass occurs because the MCP layer fails to intercept and filter these requests according to the user's permission profile before they reach the core Odoo ORM (Object-Relational Mapping) logic or processes them without applying the necessary security checks. The result is a direct leakage of confidential data that should remain hidden from unauthorized users, such as personal identification information, financial records, or proprietary business metrics depending on the specific fields targeted.
The operational impact of this vulnerability is severe, particularly in environments where Odoo MCP is used to integrate with external AI agents or automated systems. Since these integrations often operate with elevated privileges to facilitate complex workflows, an attacker who compromises a connected agent or injects malicious prompts can exploit this flaw to exfiltrate sensitive data without triggering traditional intrusion detection alerts associated with brute-force attacks or SQL injection attempts. The ability to read denied fields unredacted undermines the principle of least privilege and exposes organizations to significant compliance risks under regulations such as GDPR, HIPAA, or PCI-DSS, depending on the nature of the disclosed information. Furthermore, this data leakage can serve as a reconnaissance step for further exploitation, allowing attackers to map out system structures and identify additional targets within the Odoo instance.
This vulnerability aligns with CWE-200: Information Exposure, which covers scenarios where sensitive information is accessible to unauthorized actors due to misconfiguration or insufficient access controls. In terms of offensive security frameworks, it corresponds to ATT&CK technique T1005: Data from Local System, specifically the sub-category of data staged for exfiltration via application layer protocols. To mitigate this risk, organizations running Odoo MCP versions 1.0.0 through 1.3.2 should immediately upgrade to a patched version where field-level ACLs are properly enforced within the execute_method tool's validation logic. Additionally, administrators should implement strict input sanitization and permission checks on all external API endpoints that interact with the database layer. It is also advisable to review access logs for any suspicious patterns of read or search_read operations targeting restricted fields during the window when the vulnerability was present, as this may indicate active exploitation attempts by adversaries seeking to harvest sensitive corporate data.