Description
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.
Published: 2026-11-10
Score: 9.2 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 15 Nov 2026 07:00:00 +0000

Type Values Removed Values Added
Title Loopback Listener Misconfiguration Exposing MCP Server to Remote Access

Thu, 12 Nov 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 10 Nov 2026 11:45:00 +0000

Type Values Removed Values Added
Description A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with network access to interact with the MCP Server remotely.
Weaknesses CWE-1327
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 9.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: siemens

Published:

Updated: 2026-11-10T16:34:11.685Z

Reserved: 2026-10-19T04:39:55.733Z

Link: CVE-2026-112136

cve-icon Vulnrichment

Updated: 2026-11-10T16:34:07.915Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-10T12:17:16.540

Modified: 2026-11-12T22:09:39.233

Link: CVE-2026-112136

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-15T06:45:07Z

Weaknesses
  • CWE-1327

    Binding to an Unrestricted IP Address