CVE-2026-54446 NetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey...

CVE-2026-54446

netlicensing-mcp (Labs64) is a natural-language MCP server for the NetLicensing licensing API. Prior to 0.1.6 , the ApiKeyMiddleware in server.py fails to reject requests that carry no client API key; the downstream client then falls back to the operator's NETLICENSING_API_KEY environment variabl...