What happened
NVD published this CVSS 8.1 High vulnerability on Sept 17, 2026 describing a total absence of authentication enforcement on this MCP server's HTTP transport.
Why it matters
This is a straightforward but severe example of the widespread pattern this week of AI agent tool servers shipping without server-side authentication enforcement, letting any network-reachable attacker perform privileged licensing operations against the connected NetLicensing service.
Attack vector
Network-reachable HTTP transport requests to the /mcp endpoint that omit the x-netlicensing-api-key header, Authorization Bearer token, and apikey query parameter are still processed, letting an unauthenticated remote attacker invoke the full software-licensing management toolset (create/revoke licenses, view customer data) exposed by this MCP server.
Affected systems
NetLicensing-MCP < 0.1.6
Mitigation
Upgrade to NetLicensing-MCP >= 0.1.6; require authentication enforcement server-side rather than relying on clients to supply credentials.