---
title: NetLicensing MCP server CVE-2026-57496: path traversal in a tool argument dodges token redaction and leaks API keys | ctxsec
url: https://ctxsec.com/items/netlicensing-mcp-cve-2026-57496
description: ""
status: "confirmed (vendor GHSA); fixed 0.1.8"
published: 2026-10-15
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/netlicensing-mcp-cve-2026-57496.md)

confirmed (vendor GHSA); fixed 0.1.8

2026-10-15

### NetLicensing MCP server CVE-2026-57496: path traversal in a tool argument dodges token redaction and leaks API keys

Labs64's NetLicensing MCP Server before 0.1.8 passes the `product_number` argument of `netlicensing_get_product` straight into a REST path without checking path segments. A traversal value can redirect the call to the `/token` endpoint. The result then goes through the generic JSON wrapper instead of the token-redacting one, so a client with a non-admin API key gets plaintext APIKEY tokens back. A recovered admin token gives broad read, write and delete access to the NetLicensing account. GitHub's CNA rates it CVSS 3.1 9.6 (published Oct 15). Upgrade to 0.1.8. The general lesson for MCP builders is that output redaction tied to which tool was called breaks if a model-supplied argument can change which backend endpoint gets hit. Validate identifiers before you build URLs, and redact based on what the response contains, not which path it came from.

Sources: [GHSA-hxpf-9xvq-wph8](https://github.com/Labs64/NetLicensing-MCP/security/advisories/GHSA-hxpf-9xvq-wph8) · [CVE-2026-57496 record](https://www.cve.org/CVERecord?id=CVE-2026-57496) · [Release 0.1.8](https://github.com/Labs64/NetLicensing-MCP/releases/tag/0.1.8)