high
advisory
Siemens Mendix Studio Pro: Improper MCP Server HTTP listener restriction (CVE-2026-112136)
A vulnerability in the Siemens Mendix Studio Pro MCP Server component allows remote interaction due to improper HTTP listener restrictions. A public proof-of-concept exploit is available.
CVE search metadata
CVE search record: CVE-2026-112136. Severity: high. CVSS: 8.8. KEV: no. Product: Mendix Studio Pro. Brief: Siemens Mendix Studio Pro: Improper MCP Server HTTP listener restriction (CVE-2026-112136). Brief link: https://feed.craftedsignal.io/briefs/2026-11-cve-2026-112136/
Triage facts
Revision 1- Applicability
- Mendix Studio Pro
- Evidence
- UnknownHigh confidence
- Severity
- High
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 17:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- C3Roughly even chance
A vulnerability (CVE-2026-112136) has been identified in the Mendix Studio Pro MCP Server. The server does not properly restrict its HTTP listener to the loopback interface, which may allow an attacker with network access to interact with the MCP Server remotely.