What happened
The MCP server exposing NetLicensing's software-licensing lifecycle to AI agents fails to enforce authentication when standard credential headers are absent, allowing unauthenticated tool invocation.
Why it matters
This allows an unauthenticated party to manipulate software licensing operations via the agentic interface, but the narrow, single-vendor deployment keeps this a lower-tier catalogued finding.
Attack vector
Network-reachable HTTP transport requests to /mcp that omit the x-netlicensing-api-key header, Authorization Bearer header, and apikey query parameter are still processed, allowing unauthenticated access to licensing-management tool calls.
Affected systems
NetLicensing MCP Server < 0.1.6
Mitigation
Upgrade to NetLicensing MCP Server 0.1.6 or later.