CVE-2026-108861

Executive Summary

CVE-2026-108861 is an information disclosure vulnerability in Odoo MCP versions 1.0.0 through 1.3.2 that allows MCP clients to bypass field-level access control lists (ACLs) by invoking the execute_method tool. Attackers, including prompt-injected agents, can call read or search_read through execute_method while naming denied fields, thereby receiving their values unredacted. With a CVSS score of 4.3, the flaw primarily affects confidentiality, requiring low privileges and network access but no user interaction.

Technical Analysis

The vulnerability resides within the Odoo MCP (Model Context Protocol) server implementation. MCP clients communicate with the Odoo backend through defined tools, and execute_method is designed to allow clients to invoke arbitrary methods on Odoo models. However, the field-level ACL enforcement—which normally restricts access to sensitive fields based on user permissions—is not applied when methods are invoked through execute_method. This bypass permits a client to request fields that would otherwise be hidden or masked, effectively retrieving unredacted data.

The root cause is an access control gap: the execute_method tool likely forwards the method call without re-evaluating the caller's field-level permissions. As a result, read and search_read operations executed via this tool return all requested fields regardless of whether the user is authorized to view them. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) indicates the attack is network-exploitable, requires low privileges (an authenticated MCP client), and impacts only confidentiality with a low severity rating. The CWE-200 classification confirms it is an information exposure issue.

No public proof-of-concept or exploit code is available. The attack mechanism is inferred from the vulnerability class and the specific tool invocation described.

Exploitation Scenarios

1. Reconnaissance / Target Identification: An attacker identifies an Odoo instance exposing the MCP interface, typically on a network-accessible port. The attacker must possess valid credentials or a session token for a low-privileged MCP client, as indicated by the PR:L vector.

2. Triggering the Flaw: The attacker connects to the MCP server as an authenticated client and invokes the execute_method tool. Rather than using standard read or search_read endpoints that enforce field-level ACLs, the attacker specifies these methods as arguments to execute_method. This action bypasses the ACL checks that would normally filter out restricted fields.

3. Payload / Execution: The attacker supplies the target Odoo model, the method name (read or search_read), and a list of fields including sensitive ones (e.g., salary, personal data, internal notes). Because the ACL is not applied, the server processes the request and returns the requested field values without redaction or omission. No specific API parameter names are provided in the description; the attack relies on the generic method invocation interface.

4. Post-Exploitation Impact: The attacker obtains confidential data they are not authorized to view. This could include employee records, financial details, or other business-sensitive information stored in Odoo. The exposure may facilitate further targeted attacks, social engineering, or compliance violations. Given the low CVSS score, the immediate impact is limited to confidentiality loss, but it can be significant depending on the data stored.

Impact Assessment

The vulnerability has a CVSS base score of 4.3 (Medium), reflecting a limited confidentiality impact (C:L) with no integrity or availability impact. The attack vector is network-based (AV:N), complexity is low (AC:L), and privileges required are low (PR:L). No user interaction is needed (UI:N), and the scope is unchanged (S:U).

Business impact includes unauthorized access to sensitive field data within Odoo. Organizations using Odoo MCP 1.0.0–1.3.2 for integrations, automation, or AI agent interactions are at risk. The blast radius depends on the permissions of the compromised client: a low-privileged client could still read fields it should not access. This can lead to data leakage, regulatory penalties (e.g., GDPR, HIPAA), and erosion of trust in the Odoo MCP integration. The absence of a patch or workaround elevates the operational risk until mitigations are applied.

Detection Guidance

Sigma Rule

title: Odoo MCP execute_method ACL Bypass Attempt
id: 8f4c2a1e-9b3d-4c5f-a6e7-1d2e3f4a5b6c
status: experimental
description: Detects invocation of execute_method with read or search_read in Odoo MCP logs, indicating potential field-level ACL bypass.
author: Threat Intelligence
date: 2026-06-01
logsource:
  product: odoo
  service: mcp
detection:
  selection:
    event: 'execute_method'
    method_name:
      - 'read'
      - 'search_read'
  condition: selection
falsepositives:
  - Legitimate administrative use of execute_method with read/search_read.
level: medium
tags:
  - attack.t1213
  - cve.2026.108861

YARA Rule

rule CVE_2026_108861_Odoo_MCP_ACL_Bypass
{
    meta:
        description = "Detects exploitation attempts of CVE-2026-108861 in Odoo MCP logs or traffic"
        author = "Threat Intelligence"
        date = "2026-06-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-108861"
        severity = "medium"
    strings:
        $a = "execute_method" ascii wide nocase
        $b = "read" ascii wide nocase
        $c = "search_read" ascii wide nocase
    condition:
        $a and ($b or $c)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-108861 Odoo MCP execute_method ACL Bypass Attempt"; flow:to_server,established; content:"execute_method"; http_client_body; nocase; content:"read"; http_client_body; nocase; content:"search_read"; http_client_body; nocase; classtype:attempted-recon; sid:10000001; rev:1;)

Elastic Detection

process where event.action == "execute_method" and process.args : ("read", "search_read")

Splunk SPL Query

index=odoo_mcp sourcetype=odoo:mcp:log
| search method="execute_method" (parameters="*read*" OR parameters="*search_read*")
| table _time, user, client_ip, model, method, parameters
| sort - _time

Wazuh OSSEC Rule

<group name="odoo_mcp,">
  <rule id="100001" level="8">
    <decoded_as>json</decoded_as>
    <field name="method">execute_method</field>
    <field name="parameters">read|search_read</field>
    <description>CVE-2026-108861: Odoo MCP ACL bypass attempt via execute_method</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

Immediate Mitigations:

1. Restrict access to the Odoo MCP interface to trusted networks or IP ranges.
2. Enforce strict authentication and authorization for MCP clients; revoke unnecessary low-privileged accounts.
3. Monitor MCP logs for execute_method invocations containing read or search_read and alert on suspicious activity.
4. If possible, disable the execute_method tool entirely via configuration until a patch is available.

Patch / Upgrade Steps: No vendor patch is currently available. Monitor Odoo security advisories and the NVD entry for updates. Once a fixed version is released, upgrade Odoo MCP to the patched version immediately.

Long-Term Hardening:

• Implement robust field-level ACL enforcement across all MCP tools, including execute_method.
• Conduct regular security reviews of MCP integrations and AI agent permissions.
• Adopt the principle of least privilege for all MCP clients.
• Deploy runtime application self-protection (RASP) or API gateways to inspect and block unauthorized method invocations.

References

1. NVD – CVE-2026-108861: https://nvd.nist.gov/vuln/detail/CVE-2026-108861
2. Odoo Security Advisories: https://www.odoo.com/security
3. CWE-200: Information Exposure: https://cwe.mitre.org/data/definitions/200.html
4. MITRE ATT&CK T1213: Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
5. FIRST EPSS: Not yet scored (as of report date).