CVE Tools
Sign in

CVE-2026-25137

NixOs Odoo database and filestore publicly accessible with default odoo configuration

Published: Feb 2, 2026Updated: Feb 3, 2026 Sources: CVE List NVDCWE-306
9.1CRITICAL
NVD MITRE
EPSS Score
9.5%
Top 5.0%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
No Fix Available
Self-Check
Not available

Description

The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store. Unauthorized access is evident from http requests. If kept, searching access logs and/or Odoos log for requests to /web/database can give indicators, if this has been actively exploited. The database manager is a featured intended for development and not meant to be publicly reachable. On other setups, a master password acts as 2nd line of defence. However, due to the nature of NixOS, Odoo is not able to modify its own configuration file and thus unable to persist the auto-generated password. This also applies when manually setting a master password in the web-UI. This means, the password is lost when restarting Odoo. When no password is set, the user is prompted to set one directly via the database manager. This requires no authentication or action by any authorized user or the system administrator. Thus, the database is effectively world readable by anyone able to reach Odoo. This vulnerability is fixed in 25.11 and 26.05.

In plain language

AI Worth attention

If you run Odoo on NixOS (via nixpkgs) in versions from 21.11 up to 25.11 and 26.05, its database manager is exposed without authentication, letting strangers access or delete your database and files—this is serious and you should act, especially if your Odoo is reachable from the internet.

Executive summary

In nixpkgs, Odoo’s database manager endpoint (/web/database) is publicly reachable with no authentication on NixOS setups for versions 21.11 through before 25.11 and 26.05, enabling unauthenticated actors to delete and download the database and filestore (CWE-306, CWE-552).

If affected, business impact
Database deletion or lossFull data exposureFilestore (attachments) theftService disruption

What to do now

  1. Check whether your Odoo web app is reachable from the internet (and whether it exposes the database manager at /web/database).
  2. Review Odoo/NixOS logs for unusual requests to /web/database (especially GET/POST from outside your network).
  3. Upgrade Odoo on NixOS to a fixed version: 25.11 or 26.05.
  4. If you can’t upgrade immediately, restrict network access to Odoo (only allow your office/VPN/known IPs) so the database manager is not reachable publicly.
May need vendor / contractor work

CVSS Vector Breakdown

AV:NAC:LPR:NUI:NS:UC:HI:NA:H
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:HConfidentiality
High
I:NIntegrity
None
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

CWE-306CWE-552

Affected Products

NixOS
oss-project
nixpkgsOn-prem
Operating Systems / linux-distro

Exploitability

No known exploits, KEV entries, or remediation guidance available for this vulnerability yet.
Is your org exposed to CVE-2026-25137?We can run the check for you — a free external exposure review, no install. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

3 techniques
Collection
Initial Access
View detailed technique mapping

References

https://github.com/NixOS/nixpkgs/pull/485310
github.com
https://github.com/NixOS/nixpkgs/pull/485454
github.com
https://github.com/NixOS/nixpkgs/security/advisories/GHSA-cwmq-6wv5-f3px
github.com

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2026-25137 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows