CVE-2026-112137: CSRF
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server.
Affected Software
Event History
Frequently Asked Questions
Which installations should be considered affected?
Mendix Studio Pro 11 installations are affected if they run version 11.15.0 through versions before 11.16.0, or version 11.12.6 through versions before 11.12.7, and use the MCP Server.
What does an attacker need to exploit this issue?
An attacker needs to persuade a user to visit a malicious web page. The page can then cause the user's browser to send unauthorized HTTP requests to the local MCP Server.
How can I determine whether I am exposed?
Check the installed Mendix Studio Pro version and whether the MCP Server is in use. Systems in either affected version range should be treated as exposed to unintended actions initiated through a user's browser.