On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restricti…

CVE-2026-3431 affects SimStudio versions below 0.5.74, where MongoDB tool endpoints accept arbitrary connection parameters without authentication or host restrictions. Attackers can exploit this vulnerability to connect to any reachable MongoDB instance and perform unauthorized operations including reading, modifying, and deleting data. This represents a critical security flaw that allows complete database compromise through unauthenticated access to MongoDB endpoints.