CVE-2026-57496 NetLicensing MCP Server: REST Path Traversal Bypasses Token Redaction

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensinggetproduct passes the caller-controlled productnumber to src/netlicensingmcp/tools/products.py, which interpolat...

CVE-2026-57496

The NetLicensing MCP Server (prior to version 0.1.8 ) is vulnerable to a REST Path Traversal (CWE-22) in the netlicensing_get_product tool. The application fails to validate the caller-controlled product_number argument, allowing an attacker to inject ../token. This causes the httpx library to no...