NetLicensing MCP Server CVE-2026-57496

Requires an authenticated MCP client possessing a valid but non-administrative NetLicensing API key, connected to a netlicensing-mcp server running a version prior to 0.1.8 that exposes the netlicensing_get_product tool; no special or non-default configuration is needed, as default deployments are vulnerable. The attacker supplies '../token' (or percent-encoded equivalents like '..%2ftoken') as the product_number so httpx normalizes the path to the /token endpoint. Limiting factors: the attacker must already hold some valid API key and have network access to the MCP interface (PR:L, not fully unauthenticated); the attack yields credentials rather than direct code execution, and impact escalates only if a recoverable admin-level APIKEY exists in the account.

This is a genuine high-priority issue within its (narrow) install base, though the deployment footprint tempers absolute urgency. The CVSS 9.6 is driven by AV:N/AC:L/PR:L/UI:N with a changed scope (S:C) and C:H/I:H - a low-privileged, non-administrative API key is enough to retrieve plaintext admin credentials, and the recovered administrative token then grants account-wide read/write/delete, justifying both the scope change and the integrity impact (which is a downstream consequence of credential recovery rather than a direct write primitive of the traversal itself). No EPSS score, CISA KEV entry, or standalone exploit tool is present in the provided data, so there is no evidence of active or widespread exploitation; however, the GHSA advisory and the committed regression tests publicly document the exact working payload (../token), so exploitation detail is effectively in the open and trivial to reproduce. Signals are internally consistent: the AV:N/AC:L/PR:L vector aligns with the description's 'authenticated MCP client with a non-administrative API key,' with no conflict to flag. Net: treat as urgent for any environment actually running netlicensing-mcp < 0.1.8, but the real-world population of such environments is small.

An attacker holding only a low-privilege (non-administrative) NetLicensing API key connects to a vulnerable MCP server and invokes the netlicensing_get_product tool with product_number set to '../token'. httpx normalizes '/product/../token' to the '/token' endpoint, and because the response is serialized through the generic _wrap_json wrapper the APIKEY redaction is bypassed, returning plaintext admin token values that the attacker reuses for full account control. The precise payload is published in the GHSA advisory and the project's regression tests, making reproduction straightforward.