CVE-2026-112137
Received Received - Intake

Cross-Site Request Forgery in Mendix Studio Pro

Publication date: 2026-11-10

Last updated on: 2026-11-10

Assigner: siemens-SADP

Description
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-10
Last Modified
2026-11-10
Generated
2026-11-10
AI Q&A
2026-11-10
EPSS Evaluated
N/A
NVD
CVE-2026-112137
EUVD
EUVD-2026-120891

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
mendix mendix_studio_pro From 11.15.0 (inc) to 11.16.0 (exc)
mendix mendix_studio_pro From 11.12.6 (inc) to 11.12.7 (exc)
siemens mcp_server *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Mendix Studio Pro and its MCP Server. The MCP Server improperly validates Content-Type and Origin headers in HTTP requests, making it susceptible to Cross-Site Request Forgery (CSRF). An attacker could exploit this by tricking a user's browser into sending unauthorized requests to the local MCP Server, potentially executing unintended actions.

Impact Analysis

If exploited, this vulnerability could allow an attacker to perform actions on your behalf without your consent. This might include modifying data, changing settings, or executing commands on the MCP Server. Users of affected Mendix Studio Pro versions should update to patched versions immediately to mitigate risk.

Mitigation Strategies

Update Mendix Studio Pro to a version that fixes the vulnerability (>= V11.16.0 for V11 or >= V11.12.7 for V11.12). Disable or restrict access to the MCP Server if not required. Monitor network traffic for unusual HTTP requests targeting the MCP Server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...