VULNERABILITY INTELLIGENCE

CVE-2026-34316

CVSS score6.1 MEDIUM

EPSS probability0.40%

CISA KEVNot currently listed

Published2026-07-21

Last modified2026-10-24

Description

On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrictions. An attacker can leverage these endpoints to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data.