{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-112137","assignerOrgId":"cec7a2ec-15b4-4faf-bd53-b40f371f3a77","state":"PUBLISHED","assignerShortName":"siemens","dateReserved":"2026-10-19T04:39:55.733Z","datePublished":"2026-11-10T11:30:42.179Z","dateUpdated":"2026-11-10T11:30:42.179Z"},"containers":{"cna":{"providerMetadata":{"orgId":"cec7a2ec-15b4-4faf-bd53-b40f371f3a77","shortName":"siemens","dateUpdated":"2026-11-10T11:30:42.179Z"},"descriptions":[{"lang":"en","value":"A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro 11.12 (All versions >= V11.12.6 < V11.12.7). The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery (CSRF). This could allow a malicious web page to trick a user's browser into sending unauthorized requests and executing unintended actions on the local MCP Server."}],"affected":[{"vendor":"Siemens","product":"Mendix Studio Pro 11","versions":[{"status":"affected","version":"V11.15.0","lessThan":"V11.16.0","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"Mendix Studio Pro 11.12","versions":[{"status":"affected","version":"V11.12.6","lessThan":"V11.12.7","versionType":"custom"}],"defaultStatus":"unknown"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","baseScore":5.4,"baseSeverity":"MEDIUM"}},{"cvssV4_0":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","baseScore":5.1,"baseSeverity":"MEDIUM"}}],"problemTypes":[{"descriptions":[{"lang":"en","cweId":"CWE-352","description":"CWE-352: Cross-Site Request Forgery (CSRF)","type":"CWE"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-710379.html"}]}}}