PT-2026-62036 · Unknown · Netlicensing-Mcp
CVE-2026-57496
·
Published
2026-06-18
·
Updated
2026-07-23
CVSS v3.1
9.6
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
netlicensing-mcp version 0.1.5
Description
A path traversal issue exists in the
netlicensing get product tool due to unsanitized string interpolation of the product number variable into a REST URL path. An authenticated client can provide a value such as ../token for the product number parameter, which is normalized by the httpx library to redirect the request from the intended product endpoint to the /token endpoint. This redirection bypasses the token-specific redaction logic in the redact token read() function, allowing the recovery of plaintext API key values (the number field) and SHOP shopURL values. If the leaked token has ROLE APIKEY ADMIN privileges, an attacker can escalate their access to full account ownership.Recommendations
For version 0.1.5, implement a centralized path-segment validator in
client.py to be used by nl get, nl post, nl put, and nl delete to block path separators like .. and / in identifiers.
As a temporary workaround, avoid using the product number parameter with path traversal sequences in the netlicensing get product tool.Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Netlicensing-Mcp