Description

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey query parameter pass through ApiKeyMiddleware in src/netlicensing_mcp/server.py without authentication. The downstream api_key_ctx in src/netlicensing_mcp/client.py then falls back to the operator's NETLICENSING_API_KEY and authenticates upstream NetLicensing REST API calls under the operator account. An unauthenticated attacker can invoke MCP tools to enumerate products, licenses, licensees, and transactions, create or modify licensing objects, perform validations, and execute destructive delete operations. The issue affects HTTP deployments configured with a server-side key and does not require user interaction. This issue is fixed in version 0.1.6.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-09-17T18:16:46.040Z",
  "pubdate": "2026-09-17T18:16:46.040Z",
  "executiveSummary": "The NetLicensing MCP Server, prior to version 0.1.6, contains a critical authentication bypass vulnerability originating in the ApiKeyMiddleware. This security flaw allows unauthenticated, network-reachable attackers to interact with the NetLicensing REST API by improperly delegating authentication to the server-side environment variable. By omitting expected authentication headers and parameters, an attacker can coerce the application into using the operator's NETLICENSING_API_KEY for downstream requests. The vulnerability enables unauthorized access to sensitive licensing operations, including the enumeration, modification, and destruction of products, licenses, and transaction records. Because this issue affects deployments configured with server-side keys and requires no user interaction, it presents a high-risk scenario for organizations relying on the MCP Server for automated licensing lifecycle management. Successful exploitation results in complete compromise of the licensing data managed through the NetLicensing platform, granting the attacker the same functional privileges as the operator account without requiring valid credentials.",
  "technicalDetails": "The vulnerability resides within the ApiKeyMiddleware component located in src/netlicensing_mcp/server.py. The root cause is a flaw in the request validation logic which fails to strictly enforce the presence of authentication credentials when requests are routed to the /mcp endpoint. Specifically, the middleware logic incorrectly allows requests to proceed even when the x-netlicensing-api-key header, Authorization: Bearer token, and apikey query parameter are all absent.\nFollowing the failed authentication check in the middleware, the execution flow proceeds to src/netlicensing_mcp/client.py. Within this module, the api_key_ctx function handles the resolution of credentials for upstream requests sent to the NetLicensing REST API. Due to the incomplete validation in the middleware, the system identifies an empty credential context and automatically falls back to the server-side configured NETLICENSING_API_KEY environment variable.\nThe attack flow proceeds as follows: 1) An attacker sends an unauthenticated HTTP request to the /mcp endpoint. 2) The ApiKeyMiddleware fails to identify the absence of required authentication headers and permits the request to pass through the filter. 3) The downstream component api_key_ctx retrieves the high-privilege operator key from the server environment. 4) The server performs authorized actions against the NetLicensing REST API using the operator's context. 5) The attacker receives the response from the REST API, effectively gaining control over the licensing lifecycle.\nBecause the server-side key is treated as a default fallback rather than an error condition in the absence of user-provided tokens, the application implicitly grants the unauthenticated request the full authority of the operator. Consequently, the attacker can execute any action permitted by the operator's API key, including reading system state, modifying licensing objects, or performing destructive operations such as deleting licensees or transactions. This vulnerability is present in all versions prior to 0.1.6 and is exploitable over any network-reachable instance of the MCP Server where the environment is configured with a functional API key."
}