CVE-2026-3431

critical · 9.8

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.

9.8

CVSS

0.4%

EPSS (exploit prob.)

29th

EPSS percentile

2026-03-02

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-862

Affected products

Vendor	Product	Affected versions
sim	sim	< 0.5.74

Check a specific version with /api/v1/cve/match.

References

https://www.tenable.com/security/research/tra-2026-12

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-3431