Loading story…
CVE-2026-25137 (CVSS 9.1) affects Odoo deployments packaged for NixOS, where the Odoo database manager can be exposed to the public internet without effective authentication under default configurations. The issue is not an Odoo upstream code flaw but a packaging/configuration interaction with NixOS’s immutable configuration model: Odoo cannot persist its auto-generated (or web-UI-set) master password to the configuration file, so after restarts the instance can return to a state where the next visitor to /web/database is prompted to set the master password, enabling a race-to-claim scenario.
If reachable externally, an unauthenticated attacker can use the database manager to download or delete the entire database and associated Odoo filestore, resulting in full data exfiltration and destructive impact. Detection guidance includes reviewing web/access logs and Odoo logs for HTTP requests to /web/database as potential indicators of exposure or exploitation. The vulnerability is reported to affect NixOS Odoo setups from 21.11 to before 25.11 and 26.05, and is fixed in NixOS 25.11 and 26.05.
Map this exposure pattern across your cloud, code, and identities.
3 events from the most recent confirmed update back to the earliest known activity.
The issue was publicly disclosed as CVE-2026-25137 with a reported CVSS score of 9.1, drawing attention to the risk for Odoo deployments on NixOS. Public reporting highlighted the race condition and the potential for full database and filestore compromise.
The vulnerability was addressed in NixOS releases 25.11 and 26.05. Defenders were advised to apply the patches, disable the database manager or block access to /web/database, and review logs for requests to the exposed endpoint.
A vulnerability in the NixOS Odoo package caused the Odoo database manager endpoint to become exposed without authentication after restarts because the master password could not be persisted in NixOS configuration. This could let a remote attacker access, exfiltrate, or delete the database and Odoo filestore, and potentially set a new master password first.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ProjectDiscovery's `nuclei-templates` repository received two new vulnerability detection submissions: one for an **Odoo website information disclosure** issue and another for **`CVE-2026-3055`**. The Odoo template, submitted in pull request `#15693` by `aushack`, adds a check intended to identify exposed information on Odoo websites. The contributor said the template was validated against both a vulnerable target and a patched or non-vulnerable target to confirm detection accuracy and reduce false positives. A separate pull request, `#15721`, submitted by `shaikhyaser`, proposes a Nuclei template for `CVE-2026-3055`, a flaw discussed as potentially requiring a **SAML-enabled environment** and possibly involving **memory leakage**. Review comments in the repository show maintainers questioned whether the memory leak had been successfully reproduced, indicating the template's effectiveness and exploitability were still being evaluated and that the submission had not yet been merged at the time of review.
Jun 29, 2026
A **critical remote code execution** issue in the *n8n* open-source workflow automation platform, tracked as **CVE-2026-25049** (also published as **GHSA-6cqr-8cfr-67f8**), allows an **authenticated** user with permission to create or modify workflows to escape n8n’s expression sandbox and execute arbitrary system commands on the underlying host. The flaw stems from **insufficient input sanitization/weak sandboxing** in n8n’s expression evaluation (server-side JavaScript) and was identified during follow-up analysis after an earlier critical n8n vulnerability (**CVE-2025-68613**) was patched; researchers report the new issue effectively **bypasses prior mitigations**. Reporting indicates exploitation can lead to **full compromise** of the n8n instance, including access to the filesystem and the ability to **steal stored credentials and secrets** (e.g., API keys, OAuth tokens) and sensitive configuration, with potential for **pivoting** into connected internal services and cloud accounts in multi-tenant deployments. Public reporting also notes **public exploits** are available. n8n maintainers state the issue is patched, and affected organizations should upgrade to fixed releases (**1.123.17** and **2.5.2**), as versions **prior to 1.123.17 and 2.5.2** are impacted.
Jun 29, 2026
A high-severity flaw tracked as **CVE-2026-65595** affects **n8n** versions before **2.30.1** and, on a separate branch, before **2.29.8**. The vulnerability stems from the Token Exchange module assigning **all Public API scopes** to JWT-derived access tokens after validating an external JWT from a trusted issuer, allowing a low-privileged user to gain administrator-level Public API access when both **Token Exchange** and **Public API** are enabled. The issue is rated **CVSS v4.0 8.9** and classified as **`CWE-269` Improper Privilege Management**. Successful exploitation can let an attacker perform admin-only actions including creating or deleting users, escalating roles, modifying workflows, reading database credentials stored in connection configurations, and exporting sensitive system data. In deployments that also allow installation of unverified Community Packages, the compromise can be extended to **remote code execution** on the n8n host, creating a path to full takeover of the automation platform and its underlying server.
Jul 23, 2026