CVE-2026-108861
Description
A flaw was found in odoo-mcp. This vulnerability allows authenticated users or prompt-injected agents to bypass field-level access control lists (ACLs) by invoking the execute_method tool. By executing data retrieval operations against restricted fields, an attacker can access unredacted data, leading to unauthorized information disclosure.
Statement
This vulnerability is rated as Moderate severity rather than Important because successful exploitation requires authenticated access or an already-compromised client context, and the blast radius is confined to reading restricted field data without enabling system modification or command execution. The odoo-mcp software is not packaged, delivered, or supported in Red Hat enterprise products. Consequently, Red Hat platform and container offerings are not exposed to this security defect under default or standard configurations.
Understanding the Weakness (CWE)
Confidentiality
Technical Impact: Read Files or Directories; Read Memory; Read Application Data
Sensitive data may be exposed to attackers.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
