CISA 2026-10-29

Siemens Mendix SAML Module

CVE-2026-89209

Machine-generated analysis · WAYSCloud LLM

Versions of the Siemens Mendix SAML module prior to 4.2.4 (Mendix 10/11) and 3.6.29 (Mendix 9) are vulnerable to authentication bypass via SAML assertion replay.

Context

The advisory addresses the Siemens Mendix SAML module, which adds SAML-based single sign-on to Mendix applications. Versions earlier than 4.2.4 for Mendix 10 and 11 compatibility, and earlier than 3.6.29 for Mendix 9 compatibility, permit an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML response in IdP-initiated authentication flows. The advisory notes the module is deployed worldwide in critical manufacturing and information-technology sectors.

Operator considerations

Check: Verify the Mendix SAML module version on each Mendix deployment.
Isolate: Disable IdP-initiated single sign-on for affected instances until they are updated.
Patch: Update to Mendix SAML version 4.2.4 (or later) for Mendix 10/11 or 3.6.29 (or later) for Mendix 9 as released by Siemens.
Log: Monitor authentication logs for unexpected SAML assertions or replay activity.

From Cybersecurity and Infrastructure Security Agency ↗

Mendix SAML module contains an authentication bypass vulnerability that could allow an unauthenticated remote attacker to gain unauthorized access by replaying a valid SAML assertion in IdP-initiated authentication flows. Siemens has released new versions for the affected products and recommends to update to the latest versions.

The following versions of Siemens Mendix SAML Module are affected:

Mendix SAML (Mendix 10 compatible) vers:intdot/

Read the full advisory on CISA →