Cross-Site Request Forgery Risk in Mendix Studio Pro by Mendix

CVE-2026-112137

What is CVE-2026-112137?

A vulnerability has been identified in Mendix Studio Pro that affects specific versions due to improper validation of Content-Type and Origin headers in incoming HTTP requests. This flaw makes the MCP Server susceptible to Cross-Site Request Forgery (CSRF) attacks, potentially allowing an attacker to deceive a user's browser into issuing unauthorized requests. Such exploitation can result in unintended actions being performed on the local MCP Server, presenting considerable security concerns for users.

References