Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC AT PR UI VC VI VA CVSS EPSS %ile KEV N L N L N L N N 5.3 .0023 13.2 —
AFFECTED Product Versions Fixed Odoo MCP 1.0.0 – —
TIMELINE Oct 11 Reserved by VulnCheck Oct 11 Published (CNA: VulnCheck) Oct 13 EXPLOIT PUBLISHED — CVE-2026-108861 (erpipe-org Odoo MCP). Public exploit reference added.
Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invoking the execute_method tool. Attackers or prompt-injected agents can call read or search_read through execute_method naming denied fields to receive their values unredacted.
| Date | Event | Detail |
|---|---|---|
| October 11, 2026 | Reserved | Reserved by VulnCheck |
| October 11, 2026 | Published | Published (CNA: VulnCheck) |
| October 13, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-108861 (erpipe-org Odoo MCP). Public exploit reference added. |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| erpipe-org | Odoo MCP | — | 1.0.0 | — |
Authoritative record: CVE-2026-108861 at cve.org
Vendors: erpipe-org
Weaknesses: CWE-200
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-108861 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.
