CVE-2026-54446: Labs64 NetLicensing-MCP advisory

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

What it is

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey query parameter pass through ApiKeyMiddleware in src/netlicensing_mcp/server.py without authentication. The downstream api_key_ctx in src/netlicensing_mcp/client.py then falls back to the operator’s NETLICENSING_API_KEY and authenticates upstream NetLicensing REST API calls under the operator account. An unauthenticated attacker can invoke MCP tools to enumerate products, licenses, licensees, and transactions, create or modify licensing objects, perform validations, and execute destructive delete operations. The issue affects HTTP deployments configured with a server-side key and does not require user interaction. This issue is fixed in version 0.1.6.

Description quoted from the CVE record (assigned by GitHub_M, published 2026-09-17).

Weakness: CWE-306: Missing Authentication for Critical Function

How it can be exploited

Exploitable over the network with high attack complexity needing no privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: no. Technical impact: total.

Public exploit evidence (Exploit Observer)

Exploit Observer found 2 code repositories naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 7 references on Exploit Observer

Live scores

EPSS: 0.006
low predicted chance of attack
VEDAS: 0.986
strong exploit evidence
On CISA KEV: Not listed
Detection rule: Nuclei

Who is affected

Product	Affected	Not affected
Labs64 NetLicensing-MCP	version < 0.1.6	Not stated

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

No fixed version or vendor advisory is listed in the CVE record yet. Watch the vendor’s security page.

How to detect it

Nuclei template (active check)

NetLicensing MCP Server - Missing Authentication
NetLicensing MCP Server before 0.1.6 exposes its streamable-HTTP transport at /mcp through an ApiKeyMiddleware that forwards requests lacking the x-netlicensing-api-key header, an Authorization bearer token, and the apikey query parameter straight to the MCP application without authentication. The downstream client then authenticates to the upstream Labs64 NetLicensing REST API under the operator’s configured key, letting an unauthenticated remote caller drive the MCP tools. This template sends an unauthenticated MCP initialize request to /mcp and confirms the server completes the handshake (returning a JSON-RPC result with protocolVersion and serverInfo) instead of rejecting the missing key, proving the authentication bypass.

Name and description quoted from the template, written by VEDAS.

The template sends 1 request (POST /mcp); it decides using status, word matchers. Severity in the template: high. Marked as not yet verified against a live vulnerable target.

Run it against a host you own or are authorised to test:

bash

nuclei -u https://your-host -t CVE-2026-54446.yaml

Show the template (49 lines)

yaml

id: CVE-2026-54446

info:
  name: "NetLicensing MCP Server - Missing Authentication"
  author: vedas-arpsyndicate
  severity: high
  description: |
    NetLicensing MCP Server before 0.1.6 exposes its streamable-HTTP transport at /mcp
    through an ApiKeyMiddleware that forwards requests lacking the x-netlicensing-api-key
    header, an Authorization bearer token, and the apikey query parameter straight to the
    MCP application without authentication. The downstream client then authenticates to
    the upstream Labs64 NetLicensing REST API under the operator's configured key, letting
    an unauthenticated remote caller drive the MCP tools. This template sends an
    unauthenticated MCP initialize request to /mcp and confirms the server completes the
    handshake (returning a JSON-RPC result with protocolVersion and serverInfo) instead of
    rejecting the missing key, proving the authentication bypass.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2026-54446&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=netlicensing&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2026-54446
    cwe-id: CWE-306
  metadata:
    verified: false
  tags: cve,cve2026,netlicensing,mcp,auth-bypass
http:
  - raw:
      - |
        POST /mcp HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Accept: application/json, text/event-stream

        {"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2024-11-05","capabilities":{},"clientInfo":{"name":"vedas","version":"1.0"}}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "protocolVersion"
          - "serverInfo"
          - "jsonrpc"
        condition: and
      - type: status
        status:
          - 200

CVE-2026-54446.yaml on GitHub

References

Other references

https://github.com/Labs64/NetLicensing-MCP/security/advisories/GHSA-x9vc-9ffq-p3gj (x_refsource_CONFIRM)
https://github.com/Labs64/NetLicensing-MCP/commit/fbbb1d5ff88eb5400ec933a84e75601ebee48927 (x_refsource_MISC)
https://github.com/Labs64/NetLicensing-MCP/releases/tag/0.1.6 (x_refsource_MISC)

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer, vedas-signatures. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.