Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-3431 is a critical-severity Missing Authorization (CWE-862) vulnerability in Sim Sim. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 49% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-3431 is a critical vulnerability in SimStudio versions below 0.5.74, where the MongoDB tool endpoints accept arbitrary connection parameters from callers without authentication or host restrictions. This flaw, mapped to CWE-862 (Missing Authorization), enables attackers to proxy connections through SimStudio to external MongoDB instances. The issue carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its network accessibility and lack of prerequisites.
Remote, unauthenticated attackers who can reach the affected SimStudio instance over the network can exploit the vulnerable endpoints to connect to any reachable MongoDB server. Exploitation allows full unauthorized access to those MongoDB instances, including reading sensitive data, modifying records, and deleting information, potentially leading to complete data compromise.
The primary advisory from Tenable, available at https://www.tenable.com/security/research/tra-2026-12, provides further details on the vulnerability. Mitigation involves upgrading to SimStudio version 0.5.74 or later, which addresses the lack of authentication and restrictions on the MongoDB tool endpoints.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-9172
Vulnerability Data
On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including…
more
reading, modifying, and deleting data.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of authorization decisions on every access request, structurally eliminating missing authorization checks.
AC-24 mandates that access control decisions are applied to each request, preventing bypass of authorization logic.
AC-25 requires a tamperproof, always-invoked reference monitor that ensures authorization checks cannot be omitted.
AC-6 reduces the set of actions reachable without proper authorization, limiting blast radius of missing checks.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.18's provisioning, review, revocation and activation steps (incl. owner approval, SoD, timely removal on role/termination change) directly stop exploitation of missing authorization checks by ensuring no actor receives or retains rights to resources they should not access; the bounded remainder is that it cannot stop missing-authorization defects inside the enforcement mechanism itself once rights have been granted (e.g. flawed code that ignores the rights table).
A.8.3 directly mandates restricting access to information per policies via configuration, identity/group controls, isolation, and dynamic techniques that enforce authorization decisions, which squarely stops exploitation of missing authorization (CWE-862); the bounded remainder is non-access mechanisms such as path traversal or CSRF that are outside its scope per the AC-3/A01:2025 anchor.
Requiring formal authorization of every access request before rights are granted ensures that checks for required permissions are performed, preventing missing authorization checks from being introduced.
By requiring competent outsiders to verify that every function enforces the need-to-know principle, the control lowers the likelihood that missing authorization checks persist undetected.
Requiring evidence of minimum security capabilities and acceptance testing ensures that missing or bypassed authorization checks are detected before the delivered software is accepted.
Mandating read-only access or proxy execution by an authorized administrator ensures every requested operation is explicitly authorized before it occurs.
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.
- No fine-grained STIG row for CWE-862, a class-level weakness, and none of its children carries one either.