Remote Interaction Vulnerability in Mendix Studio Pro by Mendix
CVE-2026-112136

9.2CRITICAL

Key Information:

Vendor

Siemens
Status
Mendix Studio Pro 11
Mendix Studio Pro 11.12
Vendor
CVE Published:
10 November 2026

What is CVE-2026-112136?

A vulnerability exists in Mendix Studio Pro that affects versions of the MCP Server due to improper configuration of its HTTP listener. This misconfiguration allows the MCP Server to be inadvertently accessible from external networks instead of being limited to the loopback interface. Consequently, an attacker with network access could interact remotely with the server, potentially leading to unauthorized actions. Addressing this issue is crucial to ensuring the security posture of applications developed using Mendix Studio Pro.

Affected Version(s)

Mendix Studio Pro 11 V11.15.0

Mendix Studio Pro 11.12 V11.12.6

References

https://cert-portal.siemens.com/productcert/html/ssa-7103...

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.