Labs64 NetLicensing-MCP up to 0.1.7 Product Client client.py nl_get product_number missing encryption

Summaryinfo

A vulnerability categorized as problematic has been discovered in Labs64 NetLicensing-MCP up to 0.1.7. This affects the function nl_get of the file src/netlicensing_mcp/client.py of the component Product Client. Such manipulation of the argument product_number leads to missing encryption. This vulnerability is referenced as CVE-2026-57496. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability was found in Labs64 NetLicensing-MCP up to 0.1.7 and classified as problematic. Affected by this issue is the function nl_get of the file src/netlicensing_mcp/client.py of the component Product Client. The manipulation of the argument product_number with an unknown input leads to a missing encryption vulnerability. Using CWE to declare the problem leads to CWE-311. The product does not encrypt sensitive or critical information before storage or transmission. Impacted is confidentiality. CVE summarizes:

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensing_mcp/tools/products.py, which interpolates it into a REST path consumed by nl_get() in src/netlicensing_mcp/client.py without path-segment validation. A traversal segment can be normalized from the intended product path to the /token endpoint, after which the response is serialized through _wrap_json instead of _wrap_json_token_read, bypassing redact_token_read() protections for APIKEY number and SHOP shopURL fields. An authenticated MCP client with a non-administrative API key can retrieve plaintext token values, and a recovered administrative token can provide broad read, write, and delete access to the NetLicensing account. This issue is fixed in version 0.1.8.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-57496 since 06/24/2026. The exploitation is known to be difficult. The attack may be launched remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1600 by the MITRE ATT&CK project.

Upgrading to version 0.1.8 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Artificial Intelligence Software

Vendor

• Labs64

Name

• NetLicensing-MCP

Version

• 0.1.0
• 0.1.1
• 0.1.2
• 0.1.3
• 0.1.4
• 0.1.5
• 0.1.6
• 0.1.7

Website

• Product: https://github.com/Labs64/NetLicensing-MCP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion