What happened
Odoo MCP's field-level access control can be bypassed by calling the execute_method tool: invoking read/search_read via execute_method with denied field names returns their values unredacted. Because MCP servers are directly reachable by agents, prompt-injected content can steer the query against fields the MCP integration was meant to hide.
Why it matters
ERP data is exactly the sensitive structured data RAG/agent pipelines pull. A field-ACL bypass on the MCP boundary means agents — or the prompt-injected content that controls them — can recover payroll, pricing, or PII fields the integration explicitly redacted.
Attack vector
An MCP client (or prompt-injected agent) invokes the execute_method tool to call read or search_read while naming fields the field-level ACL denies; the unredacted values are returned, bypassing the intended field-scoping controls.
Affected systems
Odoo MCP (erpipe-org) 1.0.0 through 1.3.2 (execute_method tool)
Mitigation
Upgrade Odoo MCP beyond 1.3.2 or restrict execute_method tool availability to trusted clients (see VulnCheck advisory / erpipe-org/mcp-odoo).