CVE-2026-25137: Database Exposure in NixOs Odoo

The impact of CVE-2026-25137 is severe. An attacker can exploit this vulnerability to gain complete control over the Odoo database, including all stored data. This includes customer information, financial records, inventory data, and potentially sensitive documents stored within the Odoo file store. The ability to delete the database represents a catastrophic data loss scenario. Successful exploitation could lead to significant financial losses, reputational damage, and regulatory penalties. The exposed database manager lacks any authentication, making it trivially accessible to anyone with network access to the NixOs Odoo instance.

1. Reserved2026-01-29
2. Published2026-02-02
3. Modified2026-02-04
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-25137 is to immediately upgrade to Odoo version 25.11 or later. If upgrading is not immediately feasible, consider implementing a temporary workaround by restricting network access to the database manager. This can be achieved through firewall rules or network segmentation to limit access to trusted IP addresses only. Monitor Odoo access logs for suspicious activity, specifically requests to the /web/database endpoint. Implement a Web Application Firewall (WAF) with rules to block unauthorized access to the database manager. After upgrading, confirm the vulnerability is resolved by attempting to access the database manager from an untrusted network and verifying that access is denied.