{"id":"CVE-2026-112136","kind":"vulnerability","aliases":["CVE-2026-112136"],"related":[],"title":"Mendix Studio Pro: MCP server listens beyond localhost, exposing it to remote systems","description":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.","summary":"The MCP Server in Mendix Studio Pro binds its HTTP listener to a network interface instead of only the loopback address. A remote attacker on the network can reach the MCP Server and interact with it.","severity":"critical","cvss":9.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Mendix Studio Pro","fixed":["11.16.0"],"affected":">= 11.15.0, < 11.16.0","ecosystem":"vendor"},{"name":"Mendix Studio Pro 11.12","fixed":["11.12.7"],"affected":">= 11.12.6, < 11.12.7","ecosystem":"vendor"}],"ecosystems":[],"tags":["ai-tooling","mcp","mendix","studio-pro"],"not_affected_if":["isolated-network","mcp-server-disabled"],"how_to_check":"In Studio Pro open Preferences > AI > MCP Server: if Enable MCP Server is off, the listener is not running. Check your version under Help > About (affected: 11.12.6, and 11.15.0 up to but not including 11.16.0). If enabled, run on the workstation: lsof -nP -iTCP -sTCP:LISTEN | grep -i studio (Windows: netstat -ano) and see whether the MCP port is bound to anything other than 127.0.0.1/[::1]. Whether the bind address is user-configurable is not stated in the docs read.","fix":"- Mendix Studio Pro 11 at or above `V11.15.0` and below `V11.16.0`: move to `V11.16.0` or later (fixed version per the advisory ranges)\n- Mendix Studio Pro 11.12 at or above `V11.12.6` and below `V11.12.7`: move to `11.12.7` or later","status":"open","published_at":"2026-11-10T12:17:16+00:00","first_seen_at":"2026-11-10T12:21:53+00:00","triaged_at":"2026-11-10T12:22:28+00:00","updated_at":"2026-11-10T12:24:16+00:00","category":"ai-tooling","confidence":0.55,"triage":{"at":"2026-11-10T12:22:28Z","model":"claude-haiku-5-5","output":{"fix":"- Mendix Studio Pro 11 at or above `V11.15.0` and below `V11.16.0`: move to `V11.16.0` or later (fixed version per the advisory ranges)\n- Mendix Studio Pro 11.12 at or above `V11.12.6` and below `V11.12.7`: move to `11.12.7` or later","reach":"network","title":"Mendix Studio Pro: MCP server listens beyond localhost, exposing it to remote systems","impact":"high","summary":"The MCP Server in Mendix Studio Pro binds its HTTP listener to a network interface instead of only the loopback address. A remote attacker on the network can reach the MCP Server and interact with it.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["mendix","mcp","studio-pro"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"remote attacker drives the MCP Server on the developer's machine","analyst_note":"Confirm how to check whether the MCP Server is enabled in Studio Pro and whether the listener setting is user-configurable; check the Siemens/Mendix advisory for the full affected ranges.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["mcp-server-disabled","isolated-network"],"who_is_affected":"Teams running Mendix Studio Pro 11.12 or 11.15 with the MCP Server in use are exposed, since its HTTP listener is not restricted to loopback. Installs where the MCP Server is disabled or the machine is not reachable from other hosts are less exposed. The sources do not say how to confirm the MCP Server is enabled.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"critical"},"cost_usd":0.000775,"input_tokens":4625,"output_tokens":624,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm how to check whether the MCP Server is enabled in Studio Pro and whether the listener setting is user-configurable; check the Siemens/Mendix advisory for the full affected ranges.","search":"'-112136':16A,19A '-2026':15A,18A '11':78C '11.12':26A,86C 'access':121C 'address':55B 'affect':92C 'ai':28B 'ai-tool':27B 'allow':116C 'attack':58B,118C 'beyond':7A 'bind':42B 'could':115C 'cve':14A,17A 'expos':9A,110C 'http':44B,101C 'identifi':73C 'instead':50B 'interact':68B,123C 'interfac':49B,106C 'leav':107C 'listen':6A,45B,102C 'localhost':8A 'loopback':54B,105C 'mcp':4A,30B,36B,65B,94C,126C 'mendix':1A,20A,23A,31B,39B,75C,83C 'network':48B,61B,120C 'potenti':109C 'pro':3A,22A,25A,34B,41B,77C,85C 'product':93C 'proper':98C 'reach':63B 'remot':12A,57B,112C,128C 'restrict':99C 'server':5A,37B,66B,95C,127C 'studio':2A,21A,24A,33B,40B,76C,84C 'studio-pro':32B 'system':13A,113C 'tool':29B 'v11.12.6':89C 'v11.12.7':90C 'v11.15.0':81C 'v11.16.0':82C 'version':80C,88C 'vulner':70C","nicknames":[],"mitigations":[],"who_affected":"Developers running Mendix Studio Pro 11.12.6, or 11.15.x up to before 11.16.0, with the MCP Server enabled in Preferences are exposed, because its HTTP listener is not restricted to loopback and other machines on the network can reach it. Workstations on shared or untrusted networks matter most. Installs with the MCP Server turned off, or on isolated networks, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["mendixstudiopro","mendixstudiopro1112","studiopro","studiopro1112"],"ptokens":["11","12","mendix","pro","studio"],"labels":["aitooling","critical","mcp","mendix","studiopro"],"campaign_type":null,"search_a":"'-112136':16A,19A '-2026':15A,18A '11.12':26A 'beyond':7A 'cve':14A,17A 'expos':9A 'listen':6A 'localhost':8A 'mcp':4A 'mendix':1A,20A,23A 'pro':3A,22A,25A 'remot':12A 'server':5A 'studio':2A,21A,24A 'system':13A","search_b":"'address':55B 'ai':28B 'ai-tool':27B 'attack':58B 'bind':42B 'http':44B 'instead':50B 'interact':68B 'interfac':49B 'listen':45B 'loopback':54B 'mcp':30B,36B,65B 'mendix':31B,39B 'network':48B,61B 'pro':34B,41B 'reach':63B 'remot':57B 'server':37B,66B 'studio':33B,40B 'studio-pro':32B 'tool':29B","search_c":"'11':78C '11.12':86C 'access':121C 'affect':92C 'allow':116C 'attack':118C 'could':115C 'expos':110C 'http':101C 'identifi':73C 'interact':123C 'interfac':106C 'leav':107C 'listen':102C 'loopback':105C 'mcp':94C,126C 'mendix':75C,83C 'network':120C 'potenti':109C 'pro':77C,85C 'product':93C 'proper':98C 'remot':112C,128C 'restrict':99C 'server':95C,127C 'studio':76C,84C 'system':113C 'v11.12.6':89C 'v11.12.7':90C 'v11.15.0':81C 'v11.16.0':82C 'version':80C,88C 'vulner':70C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"productcert@siemens.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112136","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112136","severity":null,"published_at":"2026-11-10T12:17:16+00:00","modified_at":"2026-11-10T12:17:16+00:00","first_seen_at":"2026-11-10T12:21:53+00:00","fetched_at":"2026-11-10T12:21:53+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-112136:2445","url":"https://docs.mendix.com/refguide/studio-pro-mcp-server/","severity":null,"published_at":"2026-11-10T12:24:16+00:00","modified_at":"2026-11-10T12:24:16+00:00","first_seen_at":"2026-11-10T12:24:16+00:00","fetched_at":"2026-11-10T12:24:16+00:00","note":"Siemens/Mendix SSA not found (searched; NVD page unreadable via fetch). Ranges and fixes come from NVD text only, nothing verified. Mendix docs: MCP server is opt-in (Preferences > AI > MCP Server > Enable, port configurable), documented as localhost-only. 11.16.0 release notes (Oct 28) mention improved MCP connection handling but do not name this CVE. Sibling CVE-2026-112137 (CSRF in same MCP server, same ranges, CVSS 5.4) exists, so check it is not mixed up. Note 11.16.1 has a known client-certificate issue.","cites":["https://docs.mendix.com/refguide/studio-pro-mcp-server/","https://docs.mendix.com/releasenotes/studio-pro/11.16/"]}],"documents":[{"id":114949,"url":"https://docs.mendix.com/refguide/studio-pro-mcp-server/","title":"Studio Pro MCP Server | Mendix Documentation","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":114950,"url":"https://docs.mendix.com/releasenotes/studio-pro/11.16/","title":"Mendix Studio Pro 11.16 release notes","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}