CVE-2026-57496: NetLicensing MCP server leaked plaintext API keys via path traversal
Before 0.1.8, the netlicensing_get_product tool in Labs64's netlicensing-mcp put the product number straight into a REST path. Passing ../token reached the token endpoint and skipped the redaction, so a client with a non-admin key could read plaintext API keys, including admin ones.
What it is
get_product() builds the URL as /product/{product_number} with no validation. httpx normalizes /product/../token to /token, so the request goes to NetLicensing's token endpoint.
The response goes through the generic JSON wrapper instead of the token-specific one, so the code that masks APIKEY numbers and SHOP URLs never runs and raw key values come back in the tool output.
A recovered admin token gives broad read, write and delete access to the NetLicensing account. Because the input is a tool argument, a prompt-injected agent could also send it.
How to check
- Affected: netlicensing-mcp (PyPI) before 0.1.8.
How to fix
- Upgrade netlicensing-mcp to 0.1.8 or later.
- If an agent with this server had access to untrusted content, rotate your NetLicensing API keys.
pip show netlicensing-mcp | grep -i versionSources
- criticalCVE-2026-102503: Google Agent Mesh let any peer call MCP backends through an unchecked ingress
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- criticalCVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npx
- criticalCVE-2026-77366: obsidian-tc MCP server let any token read and edit any vault