Findings

CVE-2026-57496

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing.

Published Jun 18, 2026 · updated Oct 15, 2026

## REST Path Traversal Bypasses Token Redaction in netlicensing-mcp ### Summary The MCP tool in interpolates a caller-controlled argument directly into a REST URL path without any validation. Passing as the product number causes to normalize into , silently redirecting the request to the NetLicensing token endpoint instead of the intended product endpoint. The response is then serialized through the generic wrapper rather than the token-specific wrapper, bypassing all APIKEY and SHOP redaction. An authenticated MCP client can recover plaintext API key values that the token read tools intentionally mask, including admin-level APIKEY credentials. ### Details The vulnerability is a path traversal (CWE-22) that exploits the interaction between unsanitized string interpolation and 's WHATWG URL normalization. **Source — ** is inserted directly into the REST path with no validation. A value of produces the path . **Sink — ** constructs the full URL as and, per WHATWG URL normalization rules applied to absolute URLs, resolves it to . The HTTP request is therefore sent to the NetLicensing endpoint. **Redaction bypass — and ** The tool handler wraps the response via , which calls only the generic redaction. The token-specific path → is never invoked. The function at is the only code that masks APIKEY and SHOP fields; because it is not on this code path, the raw API key value is returned verbatim in the MCP tool output. **Complete data flow:** 1. — MCP dispatcher receives attacker-controlled and calls . 2. — value interpolated into without validation. 3. — ; normalizes and sends request to endpoint. 4. — response wrapped as via , not . 5. — generic redaction applies only default-field masking. 6. — with APIKEY/SHOP-specific masking is never reached. ### PoC **Prerequisites** - Python 3.10+ - 0.1.5 (or local commit ) installed or available via - , , installed **Option A — Docker (recommended, reproduces Phase 2 result)** **Option B — Direct Python** **Expected output** The fie