{"id":"CVE-2026-112136","aliases":["EUVD-2026-120890","GHSA-6m57-vrcv-v9j4"],"status":"published","title":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions \u003e= V11.15.0 \u003c V11.16.0)...","description":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions \u003e= V11.15.0 \u003c V11.16.0), Mendix Studio Pro 11.12 (All versions \u003e= V11.12.6 \u003c V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.","severity":{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00304,"percentile":0.23479,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1327"],"published":"2026-11-10T11:30:41Z","modified":"2026-11-10T12:31:57Z","products":[{"vendor":"siemens","product":"mendix studio pro 11"},{"vendor":"siemens","product":"mendix studio pro 11.12"}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-710379.html"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112136"},{"url":"https://github.com/advisories/GHSA-6m57-vrcv-v9j4"}],"sources":{"cve":[{"id":"CVE-2026-112136","description":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions \u003e= V11.15.0 \u003c V11.16.0), Mendix Studio Pro 11.12 (All versions \u003e= V11.12.6 \u003c V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.","status":"published","published":"2026-11-10T11:30:41.077Z","modified":"2026-11-10T16:34:11.685Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical","assessor":"cna"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1327"],"updated_at":"2026-11-10T12:38:31.627777Z"}],"euvd":[{"id":"EUVD-2026-120890","description":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions \u003e= V11.15.0 \u003c V11.16.0), Mendix Studio Pro 11.12 (All versions \u003e= V11.12.6 \u003c V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.","status":"published","published":"2026-11-10T11:30:41Z","modified":"2026-11-10T16:34:11Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"updated_at":"2026-11-10T14:21:12.828774Z"}],"ghsa":[{"id":"GHSA-6m57-vrcv-v9j4","title":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions \u003e= V11.15.0 \u003c V11.16.0)...","description":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions \u003e= V11.15.0 \u003c V11.16.0), Mendix Studio Pro 11.12 (All versions \u003e= V11.12.6 \u003c V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.","status":"published","published":"2026-11-10T12:31:49Z","modified":"2026-11-10T12:31:57Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"cwes":["CWE-1327"],"updated_at":"2026-11-10T12:54:11.217132Z"}],"nvd":[{"id":"CVE-2026-112136","description":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions \u003e= V11.15.0 \u003c V11.16.0), Mendix Studio Pro 11.12 (All versions \u003e= V11.12.6 \u003c V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.","status":"published","published":"2026-11-10T12:17:16.54Z","modified":"2026-11-12T22:09:39.233Z","cvss":[{"version":"4.0","score":9.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-1327"],"updated_at":"2026-11-10T20:21:09.433618Z"}]}}