Siemens Mendix SAML module has an authentication-bypass flaw
Original title: [Control Systems] Siemens security advisory (AV26-1083)
Mendix 9 builds before V3.6.29 and Mendix 10 and 11 builds before V4.2.4 are affected; Canada urges administrators to apply updates.
Canada’s Cyber Centre republished Siemens advisory SSA-137528 on October 26, 2026. Siemens reports an authentication-bypass vulnerability in Mendix SAML modules compatible with Mendix 9, 10, and 11. Affected releases are those before V3.6.29 for Mendix 9 and before V4.2.4 for Mendix 10 and 11. The notice tells users and administrators to review Siemens links and apply necessary updates.
- The Canadian serial number is AV26-1083, dated October 26, 2026.
- Mendix 10- and 11-compatible SAML modules before V4.2.4 are listed.
- The Mendix 9-compatible module is affected prior to V3.6.29.
- The bulletin cites Siemens ProductCERT and Siemens CERT.
Impact: authentication bypass in the Mendix SAML module
| Product | Affected | Fixed in |
|---|---|---|
| Siemens Mendix SAML (Mendix 10 compatible) | Prior to V4.2.4 | V4.2.4 |
| Siemens Mendix SAML (Mendix 11 compatible) | Prior to V4.2.4 | V4.2.4 |
| Siemens Mendix SAML (Mendix 9 compatible) | Prior to V3.6.29 | V3.6.29 |
- 1.Review Siemens advisory SSA-137528 and apply the available Mendix SAML updates.
- Vendors
- Siemens
- Products
- Mendix SAML
- Organizations
- Canadian Centre for Cyber Security
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1083 Date: October 26, 2026 As of October 26, 2026, Siemens is affected by a vulnerability in the following products: Mendix SAML (Mendix 10 compatible) Prior to V4. 2. 4 Mendix SAML (Mendix 11 compatible) Prior to V4.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.