Odoo MCP EUVD-2026-97012

Requires the Odoo MCP server (erpipe-org/mcp-odoo, versions 1.0.0 through 1.3.2) to expose the execute_method tool and the attacker to hold a valid MCP client session with at least low privileges (PR:L) - not anonymous access. The concrete prerequisite is the ability to call execute_method and reach Odoo's read or search_read ORM methods directly, bypassing the field-level ACL enforcement that the higher-level tools apply; the attacker must also know or guess the names of the restricted fields to request. Limiting factors: exploitation is confined to disclosure of field values the caller could enumerate, grants no integrity or availability impact, and depends on the MCP server being deployed with execute_method available. The prompt-injection path additionally requires an LLM agent with tool-calling access that can be manipulated via untrusted input.

This is a moderate-priority, confidentiality-only issue rather than an urgent emergency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 (MEDIUM) and indicates a network-reachable, low-complexity attack that still requires some privilege (PR:L) - i.e. an already-authenticated MCP client session, not a fully anonymous attacker. Impact is bounded: VC:L with VI:N/VA:N means limited confidentiality loss and no integrity or availability effect, consistent with CWE-200 field-level information disclosure. No EPSS score was supplied, so exploitation probability cannot be quantified from the data. The CVE is NOT in CISA KEV, so there is no confirmed active exploitation. No separate POC/exploit-code flag was provided; the referenced VulnCheck/hackmd advisory and the GitHub source-line pointer describe the technique but do not constitute a weaponized public exploit. One elevating factor to weigh against the modest CVSS: the description explicitly includes prompt-injected agents as a threat actor, which is realistic for AI/MCP deployments where an LLM can be coerced into calling execute_method - in those environments the effective PR barrier may be weaker than the vector implies. Net: real but contained risk, worth prioritizing for anyone running the affected MCP server in an agentic context, lower priority otherwise given its niche footprint.

An authenticated MCP client - or an AI agent that has been prompt-injected - connected to the Odoo MCP server invokes the execute_method tool to call read or search_read directly, naming fields that the server's field-level ACL would normally redact, and receives those denied values unredacted. No weaponized public exploit is identified at time of analysis, though the VulnCheck advisory and hackmd write-up document the technique in detail. The low attack complexity (AC:L) means no special timing or race conditions are needed once a session exists.