CVE-2026-3431 Sim Studio AI - MongoDB SSRF and Arbitrary Document Deletion
Unauthenticated attackers can exploit MongoDB endpoints to connect to arbitrary instances and read, modify, or delete data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-3431?
CVE-2026-3431 is a critical server-side request forgery vulnerability in SimStudioAI sim, published on 2 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.
Weakness: CWE-862
Which versions are affected by CVE-2026-3431?
It affects 1 product.
Products include Sim Sim.
How do I fix CVE-2026-3431?
No fix has been published for CVE-2026-3431 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-3431 being exploited?
There is no known exploitation of CVE-2026-3431 in the wild and no public exploit code.
Other vulnerabilities in SimStudioAI sim
- CVE-2026-3432 Sim Studio AI - Unauthenticated OAuth Token Theft
- CVE-2025-15099 simstudioai sim CRON Secret internal.ts improper authentication
- CVE-2025-7107 SimStudioAI sim route.ts handleLocalFile path traversal
- CVE-2025-7114 SimStudioAI sim Session route.ts POST missing authentication
- CVE-2025-10096 SimStudioAI sim route.ts server-side request forgery
Sources
Also known as GHSA-h3j6-r52w-6956.