Odoo 17 security vulnerabilities

Version overview

• Odoo 17 is a major Odoo series used by ERP administrators and hosting providers.
• Security posture depends on the exact Community (and optional Enterprise) revision you run — not only the major version number.
• Vendor advisories, backport policy, and installed modules all change exposure. A quiet CVE list is not a clean bill of health.

Security advisories for Odoo 17

Confirmed catalog rows attributed to this version series via affected ranges, advisory text, or CVE-linked fix commits on 17.0.

Patch information

Public, disclosed Community fix commits attributed to 17.0. Proprietary Enterprise diffs are never shown.

No public disclosed fix commits for 17.0 are listed yet (4 candidate commits exist in analysis and are withheld until disclosure criteria are met). Use the revision checker when you have a concrete SHA or package version.

Disclosed public references on file for 17.0: 0.

Security changes & hardening

Follow the Odoo security updates timeline for confirmed fixes, dependency remediations, and hardening events. Ordinary bugfixes are excluded from that timeline.

How to identify your installed revision

1. From the Odoo shell: open the database manager or Settings → About to read the build / commit when exposed by your packaging.
2. On source installs, run `git -C /path/to/odoo rev-parse HEAD` on the Community repository (and Enterprise if authorized).
3. Container or Debian packages: map the package version to the upstream commit your vendor documents — do not assume the tag equals a security backport.
4. Record both the major series (e.g. 18.0) and the full SHA before asking whether a disclosed fix is present.

Monitoring

Watch the Odoo stack for newly ingested advisories. Alerts follow your account package — they do not invent exploitability for Odoo 17.

Other recent Odoo findings that are not tied to Odoo 17. Use each CVE’s version checker before you treat one as in range.