# CVE-2026-112136: Mendix Studio Pro MCP Server unrestricted HTTP listener

Source: https://junglewise.ai/threats/cve-2026-112136-a-vulnerability-has-been-identified-in-mendix-studio-pro-11-all  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-112136 · Severity: high · CVSS 8.8 · Published 2026-11-10

Mendix Studio Pro is a low-code development IDE used by developers to build applications. An improperly configured HTTP listener in the MCP Server component allows attackers with network access to interact with the server remotely, potentially leading to unauthorized data access or system compromise without authentication.

Vendors: [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2026-112136 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-112136 being exploited in the wild.

**How severe is CVE-2026-112136?** High severity, with a CVSS score of 8.8, published 10 November 2026.

**Which products and versions are affected?** Siemens Mendix Studio Pro 11 11.15.0 to 11.15.x; Siemens Mendix Studio Pro 11.12 11.12.6 to 11.12.6.

**Is there a fix for CVE-2026-112136?** Yes: fixed in Mendix Studio Pro 11: V11.16.0 or later; Mendix Studio Pro 11.12: V11.12.7 or later. Until then: Maintain strict inbound firewall policies (such as Windows Defender Firewall) to block external traffic on port 7782, which is the default on standard Windows installations. If remote access is required, restrict traffic through a secure authenticated channel such as a VPN or SSH tunnel rather than opening direct inbound firewall rules. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-112136 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-112136?** Check whether you run Siemens Mendix Studio Pro 11 or Siemens Mendix Studio Pro 11.12 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Mendix Studio Pro 11: V11.16.0 or later; Mendix Studio Pro 11.12: V11.12.7 or later

Maintain strict inbound firewall policies (such as Windows Defender Firewall) to block external traffic on port 7782, which is the default on standard Windows installations. If remote access is required, restrict traffic through a secure authenticated channel such as a VPN or SSH tunnel rather than opening direct inbound firewall rules.

## Technical details

The MCP Server component in Mendix Studio Pro fails to restrict its HTTP listener to the loopback interface (127.0.0.1), binding to an unrestricted IP address instead (CWE-1327). An attacker with network access can reach the server remotely without authentication, potentially gaining high-impact access to confidentiality, integrity, and availability. The vulnerability requires user interaction (UI:R) in the CVSS v3.1 model but the advisory indicates network-accessible attack surface.

## Affected products

- Siemens Mendix Studio Pro 11 11.15.0 to 11.15.x
- Siemens Mendix Studio Pro 11.12 11.12.6 to 11.12.6

## Timeline

- 2026-11-10: disclosed

## References

- [https://cert-portal.siemens.com/productcert/html/ssa-710379.html](https://cert-portal.siemens.com/productcert/html/ssa-710379.html)