Labs64 NetLicensing-MCP Server versions before 0.1.6 have a missing authentication vulnerability (CWE-306) in the /mcp HTTP endpoint. Requests lacking the x-netlicensing-api-key header, Authorization: Bearer token, or apikey query parameter bypass ApiKeyMiddleware authentication. The downstream client code then uses the operator's NETLICENSING_API_KEY to authenticate upstream REST API calls, effectively granting unauthenticated attackers full access to MCP tools. This access allows enumeration of products, licenses, licensees, and transactions, as well as creation, modification, validation, and destructive deletion of licensing objects. The vulnerability affects HTTP deployments with server-side keys and requires no user interaction. The issue is resolved in version 0.1.6.

An unauthenticated attacker can fully control the licensing management functions exposed by the MCP interface, including reading sensitive licensing data and performing destructive operations such as deleting licenses. This compromises confidentiality, integrity, and availability of the licensing system under the operator's account. The vulnerability has a CVSS 3.1 score of 8.1 (high severity), indicating network exploitable with high impact on confidentiality, integrity, and availability.

Upgrade Labs64 NetLicensing-MCP to version 0.1.6 or later, where this authentication bypass vulnerability is fixed. Until upgrading, restrict network access to the /mcp endpoint to trusted users only, and avoid using HTTP transport without proper authentication. Patch status is confirmed fixed in 0.1.6.