PT-2026-22582 · Simstudio · Simstudio

CVE-2026-3431 · Published 2026-03-02 · Updated 2026-03-07

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SimStudio versions prior to 0.5.74

Description SimStudio’s MongoDB tool endpoints accept arbitrary connection parameters from callers without authentication or host restrictions. This allows an attacker to connect to any reachable MongoDB instance and perform unauthorized operations, including reading, modifying, and deleting data. The affected endpoints do not verify the validity of connection details, potentially exposing MongoDB instances to unauthorized access.

Recommendations Update SimStudio to version 0.5.74 or later.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-3431

Affected Products

Simstudio

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3431.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-3431 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3431 · Security Note
• https://github.com/simstudioai/sim · Note
• https://twitter.com/CVEnew/status/2028478024715231540 · Twitter Post
• https://twitter.com/cracbot/status/2030237086394245576 · Twitter Post
• https://tenable.com/security/research/tra-2026-12 · Note
• https://twitter.com/CveFindCom/status/2028465711127863450 · Twitter Post
• https://twitter.com/dailycve/status/2030069297716810165 · Twitter Post
• https://twitter.com/cracbot/status/2029874786206371958 · Twitter Post
• https://t.me/cveNotify/153717 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2028494126690292185 · Twitter Post
• https://twitter.com/infoflowcloud/status/2028478127823798661 · Twitter Post
• https://twitter.com/TheHackerWire/status/2028459494184022103 · Twitter Post
• https://twitter.com/cracbot/status/2029512330523111876 · Twitter Post