Detections
Analytics

SCA: security update for netlicensing-mcp (GHSA-x9vc-9ffq-p3gj)

high Tenable Cloud Security Plugin ID 444719

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the
 software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport
 requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey query parameter
 pass through ApiKeyMiddleware in src/netlicensing_mcp/server.py without authentication. The downstream
 api_key_ctx in src/netlicensing_mcp/client.py then falls back to the operator's NETLICENSING_API_KEY and
 authenticates upstream NetLicensing REST API calls under the operator account. An unauthenticated attacker
 can invoke MCP tools to enumerate products, licenses, licensees, and transactions, create or modify
 licensing objects, perform validations, and execute destructive delete operations. The issue affects HTTP
 deployments configured with a server-side key and does not require user interaction. This issue is fixed
 in version 0.1.6. (CVE-2026-54446)

Solution

Update the netlicensing-mcp library and its related packages to version 0.1.6 or later.

See Also

https://github.com/advisories/GHSA-x9vc-9ffq-p3gj

Plugin Details

Severity: High

ID: 444719

Version: Revision 1.3

Type: Local

Family: SCA Checks

Published: 7/15/2026

Updated: 9/18/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 7.6

Percentile: 98.3

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-54446

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 7/14/2026

Vulnerability Publication Date: 7/14/2026

Reference Information

CVE: CVE-2026-54446

cwe: CWE-306