Labs64 CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL Labs64 CVE published 2026-06-18

CVE-2026-57496

An authenticated MCP client can recover plaintext API key values that the token read tools intentionally mask, including admin-level APIKEY credentials, due to a path traversal vulnerability in the `netlicensing_get_product` MCP tool in `netlicensing-mcp`. The vulnerability allows an attacker to bypass token redaction and access sensitive information. Defenders should assess exposure and prioritize remedi [truncated]