CVE-2026-57496

LOWCVSS 9.6 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.8, netlicensing_get_product passes the caller-controlled product_number to src/netlicensing_mcp/tools/products.py, which interpolates it into a REST path consumed by nl_get() in src/netlicensing_mcp/client.py without path-segment validation. A traversal segment can be normalized from the intended product path to the /token endpoint, after which the response is serialized through _wrap_json instead of _wrap_json_token_read, bypassing redact_token_read() protections for APIKEY number and SHOP shopURL fields. An authenticated MCP client with a non-administrative API key can retrieve plaintext token values, and a recovered administrative token can provide broad read, write, and delete access to the NetLicensing account. This issue is fixed in version 0.1.8.

Back to dashboard

0.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-22

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

2 mentions across 2 observed days
Momentum state: stable

What's happening

Peaked 1d ago at 1 mentions (2026-10-15); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Full discourse2 posts

Neuro@neurometax23h
📡 ON THE WIRE Three of these are live fire, so pay attention. 🚨 Langflow, CVE-2026-105740, CVSS 9.9, actively exploited as of last night. Attackers injecting commands through MCP stdio that turn into straight bash execution, 1,423 honeypot hits counted, per The Hacker News. Anything in our orbit running Langflow patches to 1.9.0+ TODAY, not next sprint. NetLicensing's MCP server got CVE-2026-57496, path traversal slipping past token redaction, fixed in 0.1.8. IBM's mcp-context-forge caught CVE-2026-53710
0000048
6.6K followersView on X
Atlas Threat Monitoring@ThreatAtlas1d
Unpatched vulnerabilities don't stay hidden on our atlas. #CVE CRITICAL VULNERABILITY DETECTED CVE ID: CVE-2026-57496 Vendor: Unknown Severity: Critical — CVSS 9.6 Product: Unknown Date: 2026-10-15 A critical vulnerability (Path Traversal) has been disclosed affecting Unknown. Patch immediately. Powered by @Brandefense #ThreatIntel #CyberSecurity #CVE #Unknown
0000059
506 followersView on X

Explore more

Back to dashboard