Daily updates from Odoo
Tuesday, February 3, 2026
1 change · 17.0
Security fixes and vulnerability patches
This update fixes a security vulnerability where temporary access tokens (RDTs) were being logged in application logs. This exposed sensitive customer information like names and addresses, which could be shared externally. The change now prevents logging of these tokens, reducing the risk of data exposure.
Original PR description
Previously, the connector logged all SP-API responses for debugging purposes. When operation is `createRestrictedDataToken`, this would also log the `restrictedDataToken` in plaintext. RDTs are short-lived credentials that grant access to PII (buyer names, addresses, etc.) and should not appear in application logs. While the token is only stored in memory while in use, logs are frequently shared in support tickets, error reports, and monitoring systems without the same access controls, making credential exposure far more likely. This commit adds a parameter to disable logging for operations that return sensitive data. opw-5491878