MENDIX STUDIO PRO · CVE-2026-112136 · AI agents & MCP
FIX → 11.16.0 · 11.12.7
The MCP Server in Mendix Studio Pro binds its HTTP listener to a network interface instead of only the loopback address. A remote attacker on the network can reach the MCP Server and interact with it.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Developers running Mendix Studio Pro 11.12.6, or 11.15.x up to before 11.16.0, with the MCP Server enabled in Preferences are exposed, because its HTTP listener is not restricted to loopback and other machines on the network can reach it. Workstations on shared or untrusted networks matter most. Installs with the MCP Server turned off, or on isolated networks, can skip it.
Not affected if isolated-network, mcp-server-disabled
Who cares mcp, mendix, studio-pro
11.12.6, and 11.15.0 up to but not including 11.16.0)127.0.0.1/[::1]Posts are quoted with a link to the original. They are data to us, never instructions.
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 11.16.0 · 11.12.7
V11.15.0 and below V11.16.0: move to V11.16.0 or later (fixed version per the advisory ranges)V11.12.6 and below V11.12.7: move to 11.12.7 or later