CVE-2026-3431 CRITICAL

CVE-2026-3431: Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion

Vendor Simstudioai

Product sim

Weakness CWE-862 · Missing authorization

Published March 2, 2026

Last update March 2, 2026

View on NVD All CVEs

CVSS base score

9.8/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.

Key dates

02Disclosure timeline

March 2, 2026 CVE published

March 2, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-3431 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/862.html

Related vulnerabilities

04Related CVE

CVE-2025-58978 WordPress PDF Generator for WordPress Plugin <= 1.5.4 - Broken Access Control Vulnerability CVE-2026-3360 Tutor LMS <= 3.9.7 - Missing Authorization to Unauthenticated Arbitrary Billing Profile Overwrite via 'order_id' Parameter CVE-2025-48878 Combodo iTop vulnerable to IDOR with ModuleInstallation object CVE-2024-20413 Cisco NX-OS Bash Privilege Escalation Vulnerability CVE-2024-1857 Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates <= 2.6.6 - Missing Authorization to Unauthenticated Information Exposure