CVE-2026-3431CWE-862

Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion

Critical · published March 2, 2026

CVSS v3.1
9.8
EPSS
1%
Percentile
50.5
In the wild
Unconfirmed
What it is

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00651 · 50.5th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-03-02T13:00Z
EPSS history
Timeline
  • 02 MAR 13:00Z
    Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion
    cvelistv5