CVE-2026-54446: NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

When netlicensing-mcp is run in HTTP transport mode, the ApiKeyMiddleware fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler (server.py:1427). The downstream HTTP client then falls back to the server operator’s NETLICENSING_API_KEY environment variable (client.py:30) and uses it to authenticate every upstream call to the NetLicensing REST API. An unauthenticated network attacker can therefore invoke any MCP tool — including product listing, license creation/modification, and destructive delete operations — entirely under the operator’s identity and account quota. CVSS 3.1 Base Score: 8.1 (High).