When "netlicensing-mcp" is run in HTTP transport mode, the "ApiKeyMiddleware" fails to enforce authentication: requests that carry no client API key are unconditionally forwarded to the next handler ("server.py:1427"). The downstream HTTP client then falls back to the server operator's "NETLICENSING_API_KEY" environment variable ("client.py:30") and uses it to authenticate every upstream call to the NetLicensing REST API. An unauthenticated network attacker can therefore invoke any MCP tool — including product listing, license creation/modification, and destructive delete operations — entirely under the operator's identity and account quota. CVSS 3.1 Base Score: 8.1 (High).