Critical flaw in Mendix Studio Pro's built-in MCP Server allows unauthenticated remote access

A critical vulnerability in Mendix Studio Pro's built-in MCP Server let unauthenticated remote attackers reach it due to a network binding flaw; Siemens fixed it in versions 11.16.0 and 11.12.7.

Siemens disclosed on November 10, 2026, through a GitHub Security Advisory, that the MCP Server module built into Mendix Studio Pro, used to connect AI coding agents and IDE tools to the low-code platform, bound its HTTP listener to all network interfaces instead of loopback only. The misconfiguration let unauthenticated remote attackers reach the server.

What changed

Tracked as CVE-2026-112136 / GHSA-6m57-vrcv-v9j4, rated Critical with a CVSS v4.0 score of 9.2.
Classified under CWE-1327 (binding to an unrestricted IP address), since the MCP Server's HTTP listener was not restricted to the loopback (127.0.0.1) interface.
Affects Mendix Studio Pro 11 versions 11.15.0 up to but not including 11.16.0, and Studio Pro 11.12.6 up to but not including 11.12.7.
The attack vector is network-based, requires no authentication, and has low complexity.
A companion Medium-severity CSRF flaw in the same MCP Server, CVE-2026-112137 / GHSA-7mp2-fv3h-3g72, was disclosed the same day.
Both issues are fixed in Studio Pro V11.16.0 and V11.12.7, and are tracked together under Siemens security bulletin SSA-710379.

What it means for AI builders

Mendix built this MCP Server specifically so AI coding agents and IDE tools could call into Studio Pro, which makes the flaw more than a typical low-code bug. An unauthenticated attacker on the network could reach and potentially manipulate the integration point meant for AI agents, with the impact including unauthorized tool execution or data access. It is a concrete reminder that MCP server implementations must default to loopback-only binding rather than listening on all interfaces.

Fix and advisory status

The GitHub Advisory Database lists the advisory as unreviewed, meaning it was auto-ingested from the vendor feed rather than independently vetted. Teams running affected versions should upgrade to V11.16.0 or V11.12.7, which close both the unrestricted binding issue and the companion CSRF flaw.

Sources

Mendix Studio Pro MCP Server unrestricted IP address binding (CVE-2026-112136) (GitHub Security Advisories, November 10, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.