What is the CVSS score of CVE-2026-3431?

CVE-2026-3431 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of MongoDB are affected by CVE-2026-3431?

A critical vulnerability in SimStudio versions below 0.5.74 allows unauthenticated attackers to manipulate MongoDB database connections, potentially enabling unauthorized data access, theft, or…

How to fix or mitigate CVE-2026-3431?

Within 24 hours: Inventory all SimStudio deployments and identify which versions are below 0.5.74; disable or restrict network access to MongoDB tool endpoints if operationally feasible. Within 7 days: Implement network segmentation to limit MongoDB endpoint access to trusted internal networks only; deploy WAF rules to block suspicious MongoDB connection parameters. Within 30 days: Upgrade SimStudio to version 0.5.74 or later once available; conduct database audit logs for unauthorized access attempts or anomalies; validate patch effectiveness in a test environment before production deployment.

MongoDB CVE-2026-3431

CRITICAL

Missing Authorization (CWE-862)

2026-03-02 vulnreport@tenable.com

MongoDB Sim

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 13:16 nvd

CRITICAL 9.8

DescriptionCVE.org

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.

AnalysisAI

SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary MongoDB operations.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send crafted HTTP request to MongoDB tool endpoint

Exploit

Supply arbitrary MongoDB connection parameters

Execution

Connect to target MongoDB instance

Impact

Execute unauthorized database operations

Access

Send crafted HTTP request to MongoDB tool endpoint

Exploit

Supply arbitrary MongoDB connection parameters

Execution

Connect to target MongoDB instance

Impact

Execute unauthorized database operations

Vulnerability AssessmentAI

Exploitation	SimStudio version below 0.5.74 with MongoDB tool endpoints exposed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 9.8 — arbitrary MongoDB operations could extract, modify, or delete simulation data. Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends requests to the unprotected MongoDB endpoints with connection parameters pointing to the SimStudio database, extracting all simulation data.
Remediation	Update SimStudio. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Inventory all SimStudio deployments and identify which versions are below 0.5.74; disable or restrict network access to MongoDB tool endpoints if operationally feasible. …

Threat intelligence, references, and detailed analysis are available after sign-in.

More from same product – last 7 days

CVE-2026-11933 HIGH This Week

8.7 Jun 12

Memory disclosure and denial of service in MongoDB Server's server-side JavaScript engine allow an authenticated user wi

CVE-2026-3431 vulnerability details – vuln.today

Back

MongoDB CVE-2026-3431

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

More from same product – last 7 days

Share

External POC / Exploit Code