Technology
Siemens Mendix SAML: vulnerability CVE-2026-89209 allows authentication bypass, in a CISA republication of a Siemens advisory
Siemens disclosed CVE-2026-89209 in its Mendix SAML module, which can let an unauthenticated attacker log in remotely by replaying a valid SAML response. CISA republished the advisory on October 29 as ICSA-26-302-01.
Teams that run applications built on the Mendix platform and use the SAML module for single sign-on should check immediately which version they are running. Siemens published on Monday, October 26, 2026 security advisory SSA-137528 for vulnerability CVE-2026-89209 in the Mendix SAML module. The flaw can allow an unauthenticated attacker to enter the application remotely, provided they replay a valid SAML response.
The text published on Thursday, October 29 on CISA’s website, as ICSA-26-302-01, is a republication of the Siemens ProductCERT advisory, the company’s product security response team. CISA itself describes it as a verbatim republication, made “as is” for greater visibility. It states that it bears no responsibility for its accuracy and refers questions to Siemens. Siemens ProductCERT was the party that reported the vulnerability to CISA.
What the flaw is
Siemens describes Mendix SAML as a module that lets a cloud application authenticate its users through SAML (a language for exchanging identity information between systems), with any identity provider that supports SAML 2.0 or Shibboleth. The problem lies in flows where login starts from the identity provider itself (IdP-initiated). The affected versions do not adequately protect against the replay of a SAML response, so a valid response can be reused. The weakness is classified as CWE-294, authentication bypass by capture-replay.
The CVSS v3.1 score is 6.8, “medium”. The vector given indicates a network attack, high complexity, no privileges required, user interaction needed and high impact on confidentiality and integrity. Siemens’ page also gives a CVSS v4.0 score of 7.6, while the CISA text lists only version 3.1.
Affected versions and fixes
All versions of the Mendix SAML module for Mendix 9 older than V3.6.29 are affected, and all versions for Mendix 10 and Mendix 11 older than V4.2.4. Siemens has released new versions: V3.6.29 or later for Mendix 9 and V4.2.4 or later for Mendix 10 and 11. The updates are available on the Mendix Marketplace, on the component page numbered 1174.
As a temporary mitigation Siemens proposes disabling single sign-on initiated by the identity provider (IdP-initiated SSO). As a general security measure it recommends protecting network access with appropriate mechanisms, operating in a protected IT environment following its operational guidelines for Industrial Security, and following the recommendations in the product manuals.
For its part, CISA adds its usual recommendations for control systems. It asks for minimal exposure to the internet, control networks behind firewalls and separate from business networks and, for remote access, more secure methods such as up-to-date VPNs, after impact analysis and risk assessment.
The advisory lists critical manufacturing and information technology as the affected sectors, with deployment worldwide and the company headquartered in Germany.
