What happened
Published 2026-10-15 (NVD REST verified, CVSS 9.6, CWE-22 path traversal). The official Labs64 NetLicensing MCP server interpolates a caller-controlled product_number into a REST URL without path-segment validation; httpx normalizes the traversal segment and reroutes the call to the /token endpoint, after which the response is wrapped by _wrap_json instead of _wrap_json_token_read, bypassing the redact_token_read() redaction of APIKEY/shopURL fields. A prior sibling advisory (CVE-2026-54446) already flagged unauthenticated use of the server-side API key in HTTP mode.
Why it matters
This is a credential-redaction-bypass inside an MCP tool: the mechanism agents trust to hide secrets leaks the licensing platform's plaintext API tokens, which then escalate to an administrative token. It shows the pattern where MCP tool responses are treated as data but a traversal bug turns the tool's own response serializer into the disclosure channel — directly compromising the infrastructure the agent manages.
Attack vector
An authenticated MCP client passes a traversal segment as the product_number argument to the netlicensing_get_product tool; the value is interpolated into a REST path and normalized (e.g. /product/../token → /token), redirecting the request to the token endpoint. That response is serialized through a path that bypasses the redact_token_read protection, exposing APIKEY and SHOP URL fields — a recovered administrative token yields broad read/write/delete control of the NetLicensing account.
Affected systems
netlicensing-mcp (NetLicensing MCP Server) < 0.1.8
Mitigation
Upgrade to netlicensing-mcp 0.1.8 (fix commit b8fd0ea; GHSA-hxpf-9xvq-wph8). Until patched, do not expose the MCP server to non-administrative agents, and consider an HTTP reverse proxy that blocks traversal segments before the tool is called.