Description
A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Siemens | Mendix Studio Pro 11.12 | V11.12.6 <V11.12.7 | — |
| Siemens | Mendix Studio Pro 11 | V11.15.0 <V11.16.0 | — |
Advisories 2
- NCSC-2026-0479 Kwetsbaarheden verholpen in Siemens producten NCSC-NL (Netherlands) · Nov 11, 2026
- SSA-710379 SSA-710379: Multiple Vulnerabilities in Mendix Studio Pro's MCP Server Siemens ProductCERT · Nov 10, 2026