{
  "entry": {
    "kind": "vuln",
    "slug": "cve-2026-57496",
    "name": "CVE-2026-57496",
    "vendor": "netlicensing-mcp",
    "description": "Several MCP servers received CVEs between 7 and 15 October 2026. CVE-2026-57496 (NVD 15 October, CVSS 3.1 9.6; GHSA-hxpf-9xvq-wph8): in Labs64's netlicensing-mcp before 0.1.8, netlicensing_get_product put the caller's product_number into a REST path without validating it. A traversal value reached the /token endpoint, and the response skipped the redaction that masks APIKEY numbers and SHOP URLs, so a client with a non-admin API key could read plaintext tokens, including administrative ones that grant read, write and delete access to the NetLicensing account. CVE-2026-108865 (11 October, CVSS 3.1 8.2, CVSS 4.0 8.8): the OAuth2 server in AmoyLab Unla, an MCP gateway, never authenticated the resource owner through version 0.10.0. Anyone could register a client, request a code from /authorize and exchange it at /token for access to the OAuth-protected MCP prefixes, the proxied upstream APIs and the credentials the gateway injects; NVD lists no fixed version. CVE-2026-108953 (12 October, CVSS 4.0 8.5): mac-shell-mcp before 2.0.0 let shell metacharacters through in execute_command arguments, so an allowed command such as pwd followed by ; ran forbidden commands without approval, and a malicious prompt could trigger it. The fix is in the GitHub repository, but the newest npm release is still 1.0.4. CVE-2026-76286 (Splunk SVD-2026-1004, 7 October, CVSS 5.3): in Splunk MCP Server below 1.2.1, running a custom API tool that another user configured sent the runner's Splunk authentication token to that tool's URL.",
    "website": "https://nvd.nist.gov/vuln/detail/CVE-2026-57496",
    "repository": null,
    "documentationUrl": null,
    "license": null,
    "version": null,
    "trustLevel": "advisory",
    "capabilities": [],
    "packaging": {
      "manager": "unknown",
      "packageName": "netlicensing-mcp",
      "command": null
    },
    "configFiles": null,
    "category": "mcp-server",
    "updatedAt": "2026-10-15",
    "risk": {
      "score": 96,
      "band": "high",
      "signals": [],
      "dangerousCombos": []
    },
    "dangerousCombos": [],
    "vuln": {
      "id": "CVE-2026-57496",
      "aliases": [
        "ti-145",
        "GHSA-hxpf-9xvq-wph8"
      ],
      "title": "Four MCP Server CVEs: NetLicensing Path Traversal Unredacts Admin Tokens (CVSS 9.6), Unla Gateway Issues OAuth Tokens Without a Login, mac-shell-mcp Allowlist Bypass, Splunk MCP Server Token Leak",
      "summary": "Several MCP servers received CVEs between 7 and 15 October 2026. CVE-2026-57496 (NVD 15 October, CVSS 3.1 9.6; GHSA-hxpf-9xvq-wph8): in Labs64's netlicensing-mcp before 0.1.8, netlicensing_get_product put the caller's product_number into a REST path without validating it. A traversal value reached the /token endpoint, and the response skipped the redaction that masks APIKEY numbers and SHOP URLs, so a client with a non-admin API key could read plaintext tokens, including administrative ones that grant read, write and delete access to the NetLicensing account. CVE-2026-108865 (11 October, CVSS 3.1 8.2, CVSS 4.0 8.8): the OAuth2 server in AmoyLab Unla, an MCP gateway, never authenticated the resource owner through version 0.10.0. Anyone could register a client, request a code from /authorize and exchange it at /token for access to the OAuth-protected MCP prefixes, the proxied upstream APIs and the credentials the gateway injects; NVD lists no fixed version. CVE-2026-108953 (12 October, CVSS 4.0 8.5): mac-shell-mcp before 2.0.0 let shell metacharacters through in execute_command arguments, so an allowed command such as pwd followed by ; ran forbidden commands without approval, and a malicious prompt could trigger it. The fix is in the GitHub repository, but the newest npm release is still 1.0.4. CVE-2026-76286 (Splunk SVD-2026-1004, 7 October, CVSS 5.3): in Splunk MCP Server below 1.2.1, running a custom API tool that another user configured sent the runner's Splunk authentication token to that tool's URL.",
      "severity": "high",
      "cvss": {
        "score": 9.6,
        "vector": null,
        "version": "3.1"
      },
      "cwe": [],
      "attackType": [
        "Command injection",
        "Authentication bypass",
        "Path traversal"
      ],
      "componentType": "mcp-server",
      "component": {
        "name": "netlicensing-mcp",
        "vendor": null,
        "package": "netlicensing-mcp",
        "ecosystem": null,
        "catalogSlug": null
      },
      "affected": [
        {
          "range": "<0.1.8",
          "fixed": "0.1.8"
        }
      ],
      "exploited": false,
      "exploitPublic": false,
      "publishedAt": "2026-10-15",
      "modifiedAt": "2026-10-15",
      "lastVerified": "2026-11-01",
      "references": [
        {
          "type": "cve",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57496"
        },
        {
          "type": "advisory",
          "url": "https://github.com/advisories/GHSA-hxpf-9xvq-wph8"
        }
      ],
      "mitigation": "Upgrade netlicensing-mcp to 0.1.8 or later and rotate NetLicensing API keys that an MCP client could have read, starting with administrative ones. Keep Unla gateways off untrusted networks, or put authentication in front of /authorize and /token, until a fix is published, and rotate the credentials the gateway injects. Replace npm installs of mac-shell-mcp with a build of 2.0.0 or later from the GitHub repository, or remove it. Upgrade Splunk MCP Server to 1.2.1 or later, limit mcp_tool_admin to trusted users, review custom API tools for external URLs, and rotate the tokens of users who ran tools that someone else created.",
      "detectedByAnomity": true
    }
  }
}