CVE-2026-3431
Received Received - Intake
Unauthorized Access via MongoDB Endpoint in SimStudio

Publication date: 2026-03-02

Last updated on: 2026-03-06

Assigner: Tenable Network Security, Inc.

Description
On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-02
Last Modified
2026-03-06
Generated
2026-06-16
AI Q&A
2026-03-02
EPSS Evaluated
2026-06-15
NVD
CVE-2026-3431
EUVD
EUVD-2026-9172
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
sim sim to 0.5.74 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

The CVE-2026-3431 vulnerability affects Sim Studio AI versions prior to 0.5.74 and involves a flaw in the MongoDB tool endpoints.

These endpoints accept arbitrary connection parameters from callers without any authentication or host restrictions.

This allows an attacker to connect to any reachable MongoDB instance through these endpoints and perform unauthorized operations.

  • Reading data
  • Modifying data
  • Deleting data
Impact Analysis

This vulnerability can have a critical impact as it allows attackers to perform unauthorized operations on any reachable MongoDB instance via the vulnerable Sim Studio endpoints.

  • Attackers can read sensitive or confidential data.
  • Attackers can modify data, potentially corrupting or altering important information.
  • Attackers can delete data, leading to data loss.

Overall, this can lead to data breaches, loss of data integrity, and availability issues.

Compliance Impact

I don't know

Detection Guidance

This vulnerability involves Sim Studio versions prior to 0.5.74 where MongoDB tool endpoints accept arbitrary connection parameters without authentication or host restrictions. Detection would involve identifying if your environment is running a vulnerable version of Sim Studio and monitoring for unauthorized access attempts to these MongoDB endpoints.

Specific commands to detect exploitation attempts are not provided in the available resources.

Mitigation Strategies

The recommended immediate mitigation step is to upgrade Sim Studio to version 0.5.74 or later, as this version contains the fix for the vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-3431. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart