CVE-2026-25137

The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store. Unauthorized access is evident from http requests. If kept, searching access logs and/or Odoos log for requests to /web/database can give indicators, if this has been actively exploited. The database manager is a featured intended for development and not meant to be publicly reachable. On other setups, a master password acts as 2nd line of defence. However, due to the nature of NixOS, Odoo is not able to modify its own configuration file and thus unable to persist the auto-generated password. This also applies when manually setting a master password in the web-UI. This means, the password is lost when restarting Odoo. When no password is set, the user is prompted to set one directly via the database manager. This requires no authentication or action by any authorized user or the system administrator. Thus, the database is effectively world readable by anyone able to reach Odoo. This vulnerability is fixed in 25.11 and 26.05.

• CWE-306
• CWE-552

• https://github.com/NixOS/nixpkgs/pull/485310
• https://github.com/NixOS/nixpkgs/pull/485454
• https://github.com/NixOS/nixpkgs/security/advisories/GHSA-cwmq-6wv5-f3px

Published

Feb 2, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25130Cybersecurity AI (CAI) is a framework for AI Security. In ve…9.6
• CVE-2026-25131OpenEMR is a free and open source electronic health records …8.8
• CVE-2026-25133October is a Content Management System (CMS) and web platfor…4.8
• CVE-2026-25134Group-Office is an enterprise customer relationship manageme…8.8
• CVE-2026-25135OpenEMR is a free and open source electronic health records …4.5
• CVE-2026-25136Rucio is a software framework that provides functionality to…6.1
• CVE-2026-25138Rucio is a software framework that provides functionality to…5.3
• CVE-2026-25139RIOT is an open-source microcontroller operating system, des…9.1
• CVE-2026-2514In Progress Flowmon ADS versions prior to 12.5.5 and 13.0.3,…8.6
• CVE-2026-25140apko allows users to build and publish OCI container images …7.5
• CVE-2026-25141Orval generates type-safe JS clients (TypeScript) from any v…9.8
• CVE-2026-25142SandboxJS is a JavaScript sandboxing library. Prior to 0.8.2…10