CVE-2026-112136: Critical severity Mendix Mendix Studio Pro 11 vulnerability
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs network access to the MCP Server. No privileges are required, but user interaction is required according to the provided severity vector.
Which installations are affected?
Affected versions are Mendix Studio Pro 11 from V11.15.0 up to but not including V11.16.0, and Mendix Studio Pro 11.12 from V11.12.6 up to but not including V11.12.7.
How can I determine whether my system may be exposed?
Check whether the MCP Server HTTP listener is reachable from remote systems rather than only through the loopback interface. Systems running an affected version may be exposed if the listener accepts connections over the network.