Mendix Studio Pro MCP Listener Opens Developer Tools to Attack (CVE-2026-112136, CVE-2026-112137)

Key Takeaways

• Siemens published advisory SSA-710379 on November 10, 2026, for two flaws in Mendix Studio Pro's MCP server.
• CVE-2026-112136 lets the MCP listener bind beyond the local machine, rated CVSS 8.8 (v3.1) and 9.2 (v4.0).
• CVE-2026-112137 fails to validate Origin and Content-Type headers, enabling cross-site requests, rated CVSS 5.4.
• Fixes are in Studio Pro 11.16.0 and 11.12.7, and no exploitation has been reported.

A Local AI Helper That Was Not Local Enough

Mendix Studio Pro, a low-code development environment, includes an MCP server so AI assistants can work with projects. Siemens ProductCERT disclosed that this server could be reached from the network and from malicious web pages. Siemens has released fixed versions for both affected branches, and no attacks have been reported.

What We Know

Studio Pro's MCP server listens on port 7782 so local AI tools can query and change Mendix projects. CVE-2026-112136 means the listener could bind to network interfaces beyond loopback, making it reachable by other machines.

CVE-2026-112137 is a separate flaw. The server did not validate Origin or Content-Type headers, so a malicious web page open in the developer's browser could send requests to the local MCP server.

Affected versions include Studio Pro 11.15.x before 11.16.0 and 11.12.x before 11.12.7. Siemens and Mendix recommend upgrading. Default Windows firewall settings can reduce remote exposure for the first flaw.

The CVSS scores are 8.8 under v3.1 and 9.2 under v4.0 for the listener issue, and 5.4 for the header issue. No public exploit or attacks have been reported. The two flaws were disclosed together, share the same fixed releases, and affect developers who have enabled the MCP server for AI assistants.

What Could Happen

A developer running an affected Studio Pro version starts the MCP server for an AI assistant. If the listener binds to all interfaces and the firewall allows it, anyone on the same network could connect and issue MCP requests.

Those requests reach whatever the server exposes: project structure, application logic, data models and possibly actions that change the project. In a shared office or public network, that is a direct path into a developer's work.

The second flaw does not need network access. A developer who visits a malicious or compromised site could have that page send cross-site requests to the MCP server on localhost, if the server accepts them without checking where they came from.

Either path could expose intellectual property or let an attacker quietly plant changes in applications that later ship to users. No attacks have been reported, and patched versions are available.

Why It Matters

Development tools are adding MCP servers quickly so AI assistants can work inside them. Many of these servers assume they are only reachable from the local machine, and that assumption is often untested.

This advisory follows a familiar pattern. Earlier flaws in MCP Inspector, MCPJam and other local MCP servers combined network exposure, missing authentication and cross-site requests. Each time, a helper meant for one developer became reachable by others.

Low-code platforms raise the stakes because they hold business logic and data models for enterprise applications. A compromised project can carry changes into production.

Teams should upgrade affected branches, block unnecessary inbound access to port 7782, and inventory every MCP server running on developer machines. Local MCP servers should bind to loopback only, require authentication, and reject requests without a trusted origin. Security teams often have no record of which developer tools have started such servers.

PointGuard AI Perspective

The Mendix flaws show how quickly a local MCP helper can turn into a network service. Developers enable these servers to work with AI assistants, often without security teams knowing they exist.

PointGuard AI Agentic Endpoint Security discovers MCP servers and AI agents running on developer machines, including servers embedded in tools such as Studio Pro. It reports which ports they listen on, whether they are exposed beyond loopback, and which versions are in use, so teams can find vulnerable instances quickly.

The PointGuard AI MCP Security Gateway adds authentication and origin checks in front of MCP traffic. Requests from unknown clients or untrusted web origins are rejected before they reach the server, and every tool call is logged with the identity that made it.

Posture management ties these together. Continuous checks flag MCP servers bound to all interfaces or missing authentication, and map them to the projects and data they can reach.

The broader lesson is that every MCP server is an API. Even when it runs on a laptop, it needs authentication, network limits and patching like any other service. For low-code teams, that visibility also protects the business logic that flows from these projects into production.

Incident Scorecard Details

Total AISSI Score: 4.85/10

Criticality: 7, Developer tools with access to application projects and code. AISSI weighting: 25%

Propagation: 5, Exposure spans local tools, the network and web browsers. AISSI weighting: 20%

Exploitability: 3, Disclosed and patched; no public exploit or attacks. AISSI weighting: 15%

Supply Chain: 6, A built-in MCP component in a vendor development platform. AISSI weighting: 15%

Business Impact: 3, No reported breach or customer harm. AISSI weighting: 25%

Sources

Third-Party Sources

• Siemens ProductCERT SSA-710379
• Mendix security advisories

PointGuard AI Sources

• PointGuard AI Agentic Endpoint Security
• PointGuard AI MCP Security Gateway