What is the CVSS score of CVE-2026-3431?

CVE-2026-3431 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of MongoDB are affected by CVE-2026-3431?

A critical vulnerability in SimStudio versions below 0.5.74 allows unauthenticated attackers to manipulate MongoDB database connections, potentially enabling unauthorized data access, theft, or…

How to fix or mitigate CVE-2026-3431?

Within 24 hours: Inventory all SimStudio deployments and identify which versions are below 0.5.74; disable or restrict network access to MongoDB tool endpoints if operationally feasible. Within 7 days: Implement network segmentation to limit MongoDB endpoint access to trusted internal networks only; deploy WAF rules to block suspicious MongoDB connection parameters. Within 30 days: Upgrade SimStudio to version 0.5.74 or later once available; conduct database audit logs for unauthorized access attempts or anomalies; validate patch effectiveness in a test environment before production deployment.

MongoDB CVE-2026-3431

CRITICAL

Missing Authorization (CWE-862)

2026-03-02 vulnreport@tenable.com

MongoDB Sim

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

CVE Published

Mar 02, 2026 - 13:16 nvd

CRITICAL 9.8

DescriptionCVE.org

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.

AnalysisAI

SimStudio below 0.5.74 has a missing authorization on MongoDB tool endpoints that allows attackers to execute arbitrary MongoDB operations.

Technical ContextAI

SimStudio < 0.5.74 has a CWE-862 missing authorization vulnerability where MongoDB tool endpoints accept arbitrary connection parameters, allowing attackers to connect to any MongoDB instance.

RemediationAI

Update SimStudio. Implement authorization on all database endpoints.

More in MongoDB

View all

CVE-2013-1892 MEDIUM This Month POC

6.0 Oct 01

MongoDB before 2.0.9 and 2.2.x before 2.2.4 does not properly validate requests to the nativeHelper function in SpiderMo

CVE-2013-3969 MEDIUM This Month POC

6.5 Oct 01

The find prototype in scripting/engine_v8.h in MongoDB 2.4.0 through 2.4.4 allows remote authenticated users to cause a

CVE-2026-25887 HIGH This Week POC

7.2 Mar 06

Remote code execution in Chartbrew versions prior to 4.8.1 allows authenticated attackers with high privileges to execut

CVE-2019-2386 HIGH This Week POC

7.1 Aug 06

After user deletion in MongoDB Server the improper invalidation of authorization sessions allows an authenticated user's

CVE-2012-6619 MEDIUM This Month POC

6.4 Mar 06

The default configuration for MongoDB before 2.3.2 does not validate objects, which allows remote authenticated users to

CVE-2024-8654 CRITICAL Act Now

9.8 Sep 10

MongoDB Server may access non-initialized region of memory leading to unexpected behaviour when zero arguments are calle

CVE-2024-1351 CRITICAL Act Now

9.8 Mar 07

Under certain configurations of --tlsCAFile and tls.CAFile, MongoDB Server may skip peer certificate validation which ma

CVE-2021-20333 MEDIUM This Month POC

5.3 Jul 23

Sending specially crafted commands to a MongoDB Server may result in artificial log entries being generated or for log e

CVE-2026-13072 CRITICAL Act Now

9.2 Jul 22

Memory corruption in MongoDB standalone mongod servers running with compute mode enabled allows remote attackers to cras

CVE-2017-15535 CRITICAL Act Now

9.1 Nov 01

MongoDB 3.4.x before 3.4.10, and 3.5.x-development, has a disabled-by-default configuration setting, networkMessageCompr

CVE-2020-2268 HIGH This Week

8.8 Sep 16

A cross-site request forgery (CSRF) vulnerability in Jenkins MongoDB Plugin 1.3 and earlier allows attackers to gain acc

CVE-2013-2132 MEDIUM This Month POC

4.3 Aug 15

bson/_cbsonmodule.c in the mongo-python-driver (aka. Rated medium severity (CVSS 4.3), this vulnerability is remotely ex

Same weakness CWE-862 – Missing Authorization

View all

CVE-2023-52163 HIGH POC

8.8

CVE-2025-6205 CRITICAL POC

9.1

CVE-2025-20362 HIGH POC

8.6

CVE-2017-9232 CRITICAL POC

9.8

CVE-2023-6875 CRITICAL POC

9.8

CVE-2024-4898 CRITICAL POC

9.8

CVE-2023-32117 CRITICAL POC

9.8

CVE-2020-36719 CRITICAL POC

9.8

CVE-2026-3431 vulnerability details – vuln.today

Back

MongoDB CVE-2026-3431

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in MongoDB

Same weakness CWE-862 – Missing Authorization

Share

External POC / Exploit Code