CVE-2026-57496: 
Python vulnerability analysis and mitigation

CVE-2026-57496 is a REST path traversal vulnerability in the netlicensing-mcp Python package (pip) that allows an authenticated MCP client to bypass token redaction and recover plaintext API key values, including admin-level credentials. The flaw affects all versions up to and including 0.1.5, and was patched in version 0.1.8. It was published on June 18, 2026, by researcher r-brown (EQSTLab) via GitHub Security Advisory GHSA-hxpf-9xvq-wph8. The vulnerability carries a CVSS v3.1 score of 9.6 (Critical) (GitHub Advisory).

The root cause is CWE-22 (Path Traversal): the netlicensing_get_product MCP tool in tools/products.py interpolates the caller-controlled product_number argument directly into a REST URL path (f"/product/{product_number}") without any sanitization. Supplying ../token as the product number causes httpx to construct the URL {BASE_URL}/product/../token, which httpx then normalizes per WHATWG URL rules to {BASE_URL}/token, silently redirecting the HTTP GET to the NetLicensing token endpoint. The response is then processed by the generic _wrap_json handler (treating it as a "Product" entity) rather than the token-specific _wrap_json_token_read handler, meaning the redact_token_read() function in redaction.py:180-239 — the only code that masks APIKEY number and SHOP shopURL fields — is never invoked, and raw API key values are returned verbatim in the MCP tool output. A public proof-of-concept is included in the advisory (GitHub Advisory).

An authenticated MCP client holding any valid NetLicensing API key can exploit this vulnerability to retrieve plaintext APIKEY number and SHOP shopURL values that the dedicated token read tools (netlicensing_get_token, netlicensing_list_tokens) intentionally redact. If the recovered token carries ROLE_APIKEY_ADMIN privileges, the attacker escalates from a scoped MCP client to full account owner, gaining unrestricted read, write, and delete access over all resources in the target NetLicensing account. The vulnerability is exploitable in all deployment modes (stdio single-user and HTTP/shared) with no special configuration required (GitHub Advisory).

A working proof-of-concept is publicly available as part of the GitHub Security Advisory, including both a direct Python script and a Docker-based reproduction environment. Exploitation requires only a valid (non-admin) API key to authenticate the MCP session — no elevated privileges are needed to trigger the traversal. No evidence of in-the-wild exploitation, threat actor attribution, EPSS score, or CISA KEV catalog listing is currently available for this CVE (GitHub Advisory).

1. Obtain MCP access: Acquire any valid NetLicensing API key sufficient to authenticate an MCP session (no admin privileges required).
2. Identify vulnerable version: Confirm the target is running netlicensing-mcp version 0.1.5 or earlier (e.g., via pip show netlicensing-mcp).
3. Craft traversal payload: Prepare the path traversal string ../token as the product_number argument for the netlicensing_get_product MCP tool call.
4. Invoke the vulnerable tool: Call netlicensing_get_product(product_number="../token") via the MCP interface. Internally, this interpolates to the path /product/../token.
5. Trigger URL normalization: The httpx client normalizes /product/../token to /token per WHATWG URL rules and sends the HTTP GET request to the NetLicensing /core/v2/rest/token endpoint instead of the product endpoint.
6. Bypass redaction: The response is processed by _wrap_json(..., "Product") instead of _wrap_json_token_read(), so redact_token_read() is never called and the raw APIKEY number value is included in the tool output.
7. Extract credentials: Parse the MCP tool output to retrieve the plaintext API key value from the number field and the console_url field, which both contain the unmasked credential.
8. Escalate privileges: If the recovered token has ROLE_APIKEY_ADMIN, use it to gain full read/write/delete control over all resources in the NetLicensing account (GitHub Advisory).

• Logs: MCP server logs showing calls to netlicensing_get_product with a product_number value of ../token or other path traversal sequences (e.g., %2e%2e, %2f).
• Network: Outbound HTTP GET requests from the MCP server to the NetLicensing REST API at the /core/v2/rest/token endpoint originating from a code path that should only call /core/v2/rest/product/{id}.
• Application Behavior: MCP tool responses for netlicensing_get_product that contain fields tokenType, role, or ROLE_APIKEY_ADMIN — fields that belong to token entities, not product entities.
• Application Behavior: Presence of raw API key strings (typically UUID or long alphanumeric values) in the number field of netlicensing_get_product responses, or API key values embedded in console_url fields pointing to https://ui.netlicensing.io/#/tokens/ (GitHub Advisory).

Upgrade netlicensing-mcp to version 0.1.8 or later, which introduces a centralized path-segment validator (_validated_path()) in client.py that rejects path segments containing ., .., /, \, or control characters before constructing any upstream URL. The fix is applied to all HTTP helper functions (nl_get, nl_post, nl_put, nl_delete). No configuration-based workaround is available for versions 0.1.5 and earlier; immediate upgrade is the only remediation (GitHub Advisory).