---
id: "CVE-2026-112136"
page: "https://infrastack.ai/live/CVE-2026-112136"
kind: "vulnerability"
aliases: ["CVE-2026-112136"]
title: "Mendix Studio Pro: MCP server listens beyond localhost, exposing it to remote systems"
severity: "critical"
cvss: 9.2
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "Mendix Studio Pro", "fixed": ["11.16.0"], "affected": ">= 11.15.0, < 11.16.0", "ecosystem": "vendor"}, {"name": "Mendix Studio Pro 11.12", "fixed": ["11.12.7"], "affected": ">= 11.12.6, < 11.12.7", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ai-tooling", "mcp", "mendix", "studio-pro"]
not_affected_if: ["isolated-network", "mcp-server-disabled"]
published_at: "2026-11-10T12:17:16+00:00"
first_seen_at: "2026-11-10T12:21:53+00:00"
updated_at: "2026-11-10T12:24:16+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112136", "first_seen_at": "2026-11-10T12:21:53+00:00"}, {"source": "analyst", "url": "https://docs.mendix.com/refguide/studio-pro-mcp-server/", "first_seen_at": "2026-11-10T12:24:16+00:00", "cites": ["https://docs.mendix.com/refguide/studio-pro-mcp-server/", "https://docs.mendix.com/releasenotes/studio-pro/11.16/"]}]
exploit_sources: []
---

# Mendix Studio Pro: MCP server listens beyond localhost, exposing it to remote systems

Link for people: https://infrastack.ai/live/CVE-2026-112136 (this .md is for agents)

The MCP Server in Mendix Studio Pro binds its HTTP listener to a network interface instead of only the loopback address. A remote attacker on the network can reach the MCP Server and interact with it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Mendix Studio Pro affected >= 11.15.0, < 11.16.0 fixed 11.16.0
- vendor:Mendix Studio Pro 11.12 affected >= 11.12.6, < 11.12.7 fixed 11.12.7

## How to check

In Studio Pro open Preferences > AI > MCP Server: if Enable MCP Server is off, the listener is not running. Check your version under Help > About (affected: 11.12.6, and 11.15.0 up to but not including 11.16.0). If enabled, run on the workstation: lsof -nP -iTCP -sTCP:LISTEN | grep -i studio (Windows: netstat -ano) and see whether the MCP port is bound to anything other than 127.0.0.1/[::1]. Whether the bind address is user-configurable is not stated in the docs read.

## Fix

- Mendix Studio Pro 11 at or above `V11.15.0` and below `V11.16.0`: move to `V11.16.0` or later (fixed version per the advisory ranges)
- Mendix Studio Pro 11.12 at or above `V11.12.6` and below `V11.12.7`: move to `11.12.7` or later

## Timeline

- 2026-11-10T12:21:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112136
- 2026-11-10T12:24:16+00:00 analyst https://docs.mendix.com/refguide/studio-pro-mcp-server/ — Siemens/Mendix SSA not found (searched; NVD page unreadable via fetch). Ranges and fixes come from NVD text only, nothing verified. Mendix docs: MCP server is opt-in (Preferences > AI > MCP Server > Enable, port configurable), documented as localhost-only. 11.16.0 release notes (Oct 28) mention improved MCP connection handling but do not name this CVE. Sibling CVE-2026-112137 (CSRF in same MCP server, same ranges, CVSS 5.4) exists, so check it is not mixed up. Note 11.16.1 has a known client-certificate issue.

## Documents

- [describes] Studio Pro MCP Server | Mendix Documentation https://docs.mendix.com/refguide/studio-pro-mcp-server/
- [mentions] Mendix Studio Pro 11.16 release notes https://docs.mendix.com/releasenotes/studio-pro/11.16/

## From the sources

A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_