CVE-2026-25137

NixOs Odoo database and filestore publicly accessible with default odoo configuration

Exploitation likely. EPSS gives it a 9.9% chance of exploitation in the next 30 days. No fix published yet.

CVSS 3.19.1Critical EPSS percentile95th9.9% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-02-02Updated 2026-02-03Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether your Odoo web app is reachable from the internet (and whether it exposes the database manager at /web/database).
Review Odoo/NixOS logs for unusual requests to /web/database (especially GET/POST from outside your network).
Upgrade Odoo on NixOS to a fixed version: 25.11 or 26.05.
If you can’t upgrade immediately, restrict network access to Odoo (only allow your office/VPN/known IPs) so the database manager is not reachable publicly.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store. Unauthorized access is evident from http requests. If kept, searching access logs and/or Odoos log for requests to /web/database can give indicators, if this has been actively exploited. The database manager is a featured intended for development and not meant to be publicly reachable. On other setups, a master password acts as 2nd line of defence. However, due to the nature of NixOS, Odoo is not able to modify its own configuration file and thus unable to persist the auto-generated password. This also applies when manually setting a master password in the web-UI. This means, the password is lost when restarting Odoo. When no password is set, the user is prompted to set one directly via the database manager. This requires no authentication or action by any authorized user or the system administrator. Thus, the database is effectively world readable by anyone able to reach Odoo. This vulnerability is fixed in 25.11 and 26.05.

In plain language

Written by AI from the record

If you run Odoo on NixOS (via nixpkgs) in versions from 21.11 up to 25.11 and 26.05, its database manager is exposed without authentication, letting strangers access or delete your database and files—this is serious and you should act, especially if your Odoo is reachable from the internet.

In nixpkgs, Odoo’s database manager endpoint (/web/database) is publicly reachable with no authentication on NixOS setups for versions 21.11 through before 25.11 and 26.05, enabling unauthenticated actors to delete and download the database and filestore (CWE-306, CWE-552).

If you're affected

Database deletion or loss
Full data exposure
Filestore (attachments) theft
Service disruption

What is it

Think of Odoo like your company’s filing cabinet: it holds your customer records, invoices, and uploaded documents. On affected NixOS setups, the “database manager” door can end up unlocked to anyone who can reach your Odoo website. That means an attacker could take all your files or wipe the cabinet entirely—similar to leaving the storage room key on the front desk.

Who is affected

This matters if you run Odoo on NixOS using the nixpkgs packaging, specifically in the affected version range. It becomes dangerous when your Odoo server (including its web endpoints) is reachable from the internet or other untrusted networks. The exposure is effectively prevented only if the database manager is not reachable publicly.

How urgent is it

Treat this as a high-priority fix because unauthenticated attackers can reach the database manager when the service is exposed, enabling database and filestore theft or deletion. While there’s no confirmed KEV listing and no public exploit code found, the issue is directly tied to public reachability and serious impact, so you should upgrade promptly if you’re in the affected versions.

What to do — in detail

Confirm exposure
- Determine whether your Odoo is reachable from the internet (public DNS name/IP, open firewall ports, or a reverse proxy that forwards to Odoo).
- From a system outside your network, try to access the database manager URL path: /web/database on your Odoo site.
  - If it loads without asking for authentication, you are very likely affected.
Look for signs of active or attempted exploitation
- Search Odoo logs and/or reverse proxy / web server logs for requests to /web/database.
- Pay attention to requests from unexpected IPs, unusual request rates, and any follow-on actions that could correspond to downloading or deleting the database.
Verify your Odoo/NixOS version
- Identify which version of Odoo you’re running via the nixpkgs channel/build (confirm it falls within: from 21.11 up to before 25.11, and 26.05).
Upgrade to the fixed versions
- Upgrade to 25.11 or 26.05 (these are the versions reported as fixed).
- If you use NixOS, ensure your deployment picks up the updated nixpkgs/Odoo package and that services are restarted after the switch.
- Breaking-change note: no specific breaking changes were provided in the findings; however, do your normal upgrade validation for Odoo (app login, scheduled jobs, background workers).
Immediate mitigation if you can’t upgrade right away
- Restrict network access so /web/database is not reachable publicly.
- Practical options: firewall rules to allow only your office/VPN IP ranges, or reverse proxy rules that block /web/database from the internet.
After upgrading
- Re-check /web/database access from outside your network.
- Continue log monitoring for /web/database for at least several days to catch any probing or lingering automated scans.
CISA due date
- Not provided in the supplied findings (no KEV listing).

Technical context

Severity is high (reported CVSS 9.1) due to network exposure with no required privileges or user interaction (unauthenticated access over the network) and impact that includes confidentiality and availability. The underlying weaknesses are identified as CWE-306 (Missing Authentication for Critical Function) and CWE-552 (Files or Directories Accessible to External Parties), matching the scenario where Odoo’s database manager is intended for development use but becomes reachable publicly. Findings state that for NixOS Odoo setups from 21.11 to before 25.11 and 26.05, the database manager is publicly exposed without any authentication, allowing unauthorized actors to delete and download the database and the filestore (Odoo attachments/files). The fix is reported to be available in 25.11 and 26.05. There is no KEV listing and no public exploit code on record; exploitation maturity is therefore not confirmed here, but the architecture described (public reachability of a critical endpoint) makes it directly impactful for exposed instances. Press attention is unknown.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS95th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

9.9% chance of exploitation activity in the next 30 days, which ranks it in the 95th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 149 days, from the signal feeds we watch.

2026-07-01EPSS band changemoderate → 0epss band change
2026-06-22EPSS band changelow → moderate
2026-02-03Record updated
2026-02-02Publishedweakness classified, att&ck mapped

Affected products

NixOSoss-project
- nixpkgsOn-premOperating Systems / linux-distro

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Scored 9.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

CollectionT1005Data from Local Systemhigh confidence
Initial AccessT1078Valid Accountshigh confidence T1190Exploit Public-Facing Applicationhigh confidence

Sources

References in the record

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Nixpkgs, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account