CVE-2026-112137

A website could cause a browser to send unauthorized requests to Studio Pro

Siemens / Mendix · Mendix Studio Pro MCP server

First documented disclosure · Review checkpoint

Summary

The developer’s browser could be induced to submit unintended actions to the local MCP service.

Severity and exploitation evidence

Medium · 5.1/10 · CVSS 4.0. Severity source.

Exploitation not established: The reviewed sources describe the vulnerability and its conditions. They do not identify malicious exploitation.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The server did not adequately validate a request’s origin or content type.

Conditions required

The MCP server is running and the user visits a malicious page in a browser capable of reaching the local service.

Potential impact

The browser could cause unintended actions with the local service’s permissions.

Affected versions and configurations

Studio Pro 11.15.0 up to 11.16.0, exclusive, and the 11.12 line from 11.12.6 up to 11.12.7, exclusive.

Fix and mitigation status

11.16.0 or 11.12.7 on the corresponding release line.

Practical next steps

Upgrade on the affected release line. Siemens also recommends browser protections against requests from public sites to private network services.

Operating lesson

Require origin checks on development services that accept browser traffic.

Evidence and limits

The browser-mediated issue is distinct from the network-listener flaw disclosed in the same advisory.

Sources