CVE-2026-3431Disclosure(sim / sim)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.

sim CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://www.tenable.com/security/research/tra-2026-12

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

9 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 9 signals
Disclosure: 8 classified signals
General: 1 classified signal
Peaked 3d ago at 5 mentions (2026-03-02); latest day: 1
9 total mentions across 4 days

Affected systems

Vendors

sim

Products

sim

Deep dive

Activity timeline9 mentions / 4d

Signal classification2 categories

Disclosure

888.9%

General

111.1%

Referenced assets8 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-02	5	Disclosure5
2026-03-05	1	Disclosure1
2026-03-06	2	Disclosure2
2026-03-07	1	General1

Full discourse9 posts

CRAC Learning - Tech@cracbot215d
General
CVE-2026-3431 (CVSS:9.8, CRITICAL) is Analyzed. On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller ..https://nvd.nist.gov/vuln/detail/CVE-2026-3431 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
CVE-2026-3431 is a critical flaw in SimStudio versions below 0.5.74, allowing attackers to supply arbitrary MongoDB connection parameters, yet no PoC, exploit, patch, or activity reports are disclosed.
0000022
173 followersView on X
DailyCVE@dailycve216d
Disclosure
🔴 SimStudio, Missing Authorization, #CVE-2026-3431 (Critical) https://dailycve.com/simstudio-missing-authorization-cve-2026-3431-critical/
Post summary
The post announces CVE‑2026‑3431, a missing authorization flaw in SimStudio rated critical, without providing PoC, exploit, or patch details.
0000038
164 followersView on X
CRAC Learning - Tech@cracbot216d
Disclosure
CVE-2026-3431 (CVSS:9.8, CRITICAL) is Undergoing Analysis. On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller ..https://nvd.nist.gov/vuln/detail/CVE-2026-3431 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The tweet announces CVE-2026-3431 is under analysis, indicating a critical MongoDB endpoint vulnerability in SimStudio versions below 0.5.74, but provides no PoC, exploit, or patch information.
0000022
173 followersView on X
CRAC Learning - Tech@cracbot217d
Disclosure
CVE-2026-3431 (CVSS:9.8, CRITICAL) is Undergoing Analysis. On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller ..https://nvd.nist.gov/vuln/detail/CVE-2026-3431 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
A critical (CVSS 9.8) vulnerability in SimStudio versions below 0.5.74 allows arbitrary MongoDB connection parameters, and it is currently under analysis.
0000023
173 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds220d
Disclosure
CVE-2026-3431 SimStudio MongoDB Endpoint Vulnerability Allows Unauthorized Datab... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-3431 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The tweet announces CVE-2026-3431, a SimStudio MongoDB endpoint vulnerability that permits unauthorized database access, and links to a vulnerability details page.
0000038
4.0K followersView on X
Infoflowcloud@infoflowcloud220d
Disclosure
🚨*CVE* CVE-2026-3431 On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An … https://www.cve.org/CVERecord?id=CVE-2026-3431 ----- Traducción: CVE-2026-3431 En … http://infoflow.cloud`
Post summary
The post announces CVE‑2026‑3431, noting that SimStudio versions below 0.5.74 allow unauthenticated arbitrary MongoDB connection parameters, but no PoC, exploit, or patch is mentioned.
0000035
55 followersView on X
CVE@CVEnew220d
Disclosure
CVE-2026-3431 On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An … https://www.cve.org/CVERecord?id=CVE-2026-3431
Post summary
The CVE describes an authentication bypass in SimStudio’s MongoDB tool endpoints, allowing callers to supply arbitrary connection parameters without restrictions.
00000241
56.6K followersView on X
CVEFind.com@CveFindCom220d
Disclosure
[CVE-2026-3431: CRITICAL] Security alert: SimStudio versions below 0.5.74 have MongoDB tool endpoints vulnerable to unauthorized access. Attackers can exploit this to manipulate MongoDB instances.#cve,CVE-2026-3431,#cybersecurity https://cvefind.com/CVE-2026-3431
Post summary
The post announces a critical vulnerability (CVE-2026-3431) in SimStudio versions below 0.5.74, exposing MongoDB tool endpoints to unauthorized access and enabling attackers to manipulate MongoDB instances.
0000060
590 followersView on X
The Hacker Wire@TheHackerWire220d
Disclosure
🔴 CVE-2026-3431 - Critical On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverag... https://www.thehackerwire.com/vulnerability/CVE-2026-3431/ https://t.co/KbVguSLYDu
Post summary
The post announces CVE-2026-3431, noting that SimStudio versions below 0.5.74 allow unauthenticated MongoDB endpoint connections with arbitrary parameters, but no PoC, exploit, or patch is mentioned.
0000050
122 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	sim	sim	-	-	-

Explore more

Back to dashboard sim CVEs sim vulnerabilities

What researchers are saying

CVE-2026-3431

CRAC Learning - Tech@cracbotGeneral

CVE-2026-3431 is a critical flaw in SimStudio versions below 0.5.74, allowing attackers to supply arbitrary MongoDB connection parameters, yet no PoC, exploit, patch, or activity reports are disclosed.

DailyCVE@dailycveDisclosure

The post announces CVE‑2026‑3431, a missing authorization flaw in SimStudio rated critical, without providing PoC, exploit, or patch details.

CRAC Learning - Tech@cracbotDisclosure

The tweet announces CVE-2026-3431 is under analysis, indicating a critical MongoDB endpoint vulnerability in SimStudio versions below 0.5.74, but provides no PoC, exploit, or patch information.

CRAC Learning - Tech@cracbotDisclosure

A critical (CVSS 9.8) vulnerability in SimStudio versions below 0.5.74 allows arbitrary MongoDB connection parameters, and it is currently under analysis.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The tweet announces CVE-2026-3431, a SimStudio MongoDB endpoint vulnerability that permits unauthorized database access, and links to a vulnerability details page.

Infoflowcloud@infoflowcloudDisclosure

The post announces CVE‑2026‑3431, noting that SimStudio versions below 0.5.74 allow unauthenticated arbitrary MongoDB connection parameters, but no PoC, exploit, or patch is mentioned.

CVE@CVEnewDisclosure

The CVE describes an authentication bypass in SimStudio’s MongoDB tool endpoints, allowing callers to supply arbitrary connection parameters without restrictions.

CVEFind.com@CveFindComDisclosure

The post announces a critical vulnerability (CVE-2026-3431) in SimStudio versions below 0.5.74, exposing MongoDB tool endpoints to unauthorized access and enabling attackers to manipulate MongoDB instances.