al-ice.ai

The Loopback Was a Suggestion: Two CVEs in Mendix Studio Pro’s MCP Server Expose Port 7782 to the Network

AI Vulnerabilities & CVEs by al-ice.ai Editorial

Siemens ProductCERT published advisory SSA-710379 (version 1.0, 10 November 2026) for two vulnerabilities in the MCP Server of Mendix Studio Pro, the vendor’s low-code IDE — and the NVD records for both CVEs landed the same day. CVE-2026-112136 (CWE-1327, binding to an unrestricted IP address) is rated CVSS 8.8 HIGH on the v3.1 scale and 9.2 on the v4.0 scale: the MCP Server’s HTTP listener is not restricted to the loopback interface, so anyone with network access can interact with it remotely. CVE-2026-112137 (CWE-352, cross-site request forgery) is rated CVSS 5.4 MEDIUM: the server does not validate Content-Type and Origin headers, so a malicious web page can trick a developer’s browser into issuing unauthorized requests to the local MCP Server. Affected: Studio Pro 11 from V11.15.0 up to but not including V11.16.0, and 11.12 from V11.12.6 up to but not including V11.12.7. Fixes ship in 11.16.0 and 11.12.7.

An 8.8 that lives on the developer’s machine

The severity math is worth reading carefully. The v3.1 vector for CVE-2026-112136 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) prices in a user-interaction requirement, while the v4.0 secondary scoring (AT:P, no user interaction) pushes it to 9.2 — either way, full confidentiality, integrity, and availability impact on a component whose entire job is executing tools on behalf of an AI-assisted IDE. Siemens’ own mitigation names the port: maintain strict inbound firewall policies blocking external traffic on port 7782, noting this is already the default on standard Windows installations, and route any legitimate remote access through a VPN or SSH tunnel rather than opening inbound rules. For the CSRF flaw, Siemens recommends modern Chromium- or WebKit-based browsers with Private Network Access protections enabled, or extensions such as uBlock Origin or NoScript to block external sites from issuing fetch requests to localhost. This is the localhost-MCP threat class in its purest industrial form: a server built on the assumption that “local” means “trusted,” meeting a network that does not honor the assumption.

The pattern keeps repeating across the MCP stack

This pair belongs on the same shelf as the month’s other MCP-server findings. The seven-CVE batch across MCP reference servers and Desktop Commander covered the same failure family — SSRF via URL validation gaps, fail-open blocklists, node-local shell bypasses — and Microsoft’s October cloud batch included an Azure SRE Agent record at 9.6 under a CWE-918 server-side-request-forgery heading. What makes Mendix notable is the venue: not an experimental harness or a reference implementation, but a mainstream enterprise low-code platform whose MCP Server ships to professional developers building production apps on the Mendix Platform. Every MCP endpoint that binds wider than loopback and skips origin validation is a standing invitation for the exact attack the CSRF record describes — a drive-by web page reaching into the developer’s toolchain — and the 112136 record shows the invitation was network-wide, not just browser-mediated.

What to actually do

  1. Update Mendix Studio Pro to 11.16.0 or 11.12.7 (or later) now; both CVEs are fixed there and Siemens’ advisory treats the upgrade as the remediation.
  2. Verify port 7782 is not reachable beyond the machine: audit host firewall rules on every developer workstation and build host running Studio Pro, and treat any inbound allow-rule for the MCP Server as a finding until replaced by VPN or SSH-tunnelled access.
  3. Enable Private Network Access protections in managed browsers (or enforce an equivalent extension policy) so external pages cannot issue requests to localhost MCP endpoints — this blunts the whole CSRF-against-localhost class, not just CVE-2026-112137.
  4. Inventory every MCP server bound to non-loopback interfaces in your environment, vendor-shipped or otherwise: the unrestricted-bind flaw is a configuration-shaped vulnerability that scanners routinely miss, and this month’s batches show it recurring across unrelated implementations.

Our verification was read-only. We read Siemens Security Advisory SSA-710379 (V1.0, publication and last update 10 November 2026) first-hand in full: both CVE IDs, affected ranges (V11.15.0–V11.16.0 exclusive; V11.12.6–V11.12.7 exclusive), remediations (11.16.0 / 11.12.7), port-7782 firewall mitigation, VPN/SSH-tunnel guidance, Private Network Access and extension mitigations, and the CWE-1327 / CWE-352 descriptions. We pulled both NVD JSON records first-hand the same day (published 10 November 2026, 12:17 UTC: 112136 at CVSS 3.1 8.8 / 4.0 9.2; 112137 at 5.4 / 5.1; each referencing only the Siemens advisory). We ran no Mendix instance, tested no request, scanned no host, and contacted no vendor. Brave Search was used for discovery only.

Sources: