STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

If passwords are used for authentication, MongoDB must store only hashed, salted representations of passwords.

DISA Rule

SV-265917r1028796_rule

Vulnerability Number

V-265917

Group Title

SRG-APP-000171-DB-000074

Rule Version

MD7X-00-003800

Severity

CAT I

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

1. Define authenticationMechanisms in the MongoDB Configuration file (default location: /etc/mongod.conf), define one of more authenticationMechanisms, from the subset below:

SCRAM-SHA-256
MONGODB-X509
GSSAPI
PLAIN

Example:

setParameter:
authenticationMechanisms: SCRAM-SHA-256

2. authSchemaVersion should be more than 5.

Run the following command:

> db.adminCommand({authSchemaUpgrade: 1})

In the unlikely event that an error is encountered, users may safely rerun the authSchemaUpgrade command.

Check Contents

MongoDB supports several authentication mechanisms, some of which store credentials on the MongoDB server.

If these mechanisms are in use, MongoDB's authSchemaVersion in the admin.system.version collection must be set to "5".

1. Validate that authenticationMechanisms is defined in config file (default location /etc/mongod.conf).

The MongoDB Configuration file should contain the similar to the following entry:

setParameter:
authenticationMechanisms: SCRAM-SHA-256

If the config file does not contain an authenticationMechanisms entry, that is a finding.

2. Validate authSchemaVersion is set to "5".

Using the shell, run the following command:

> db.getSiblingDB("admin").system.version.find({ "_id" : "authSchema"}, {_id: 0})

It should return:

{ "currentVersion" : 5 }

If currentVersion is less than 5, this is a finding.

Vulnerability Number

V-265917

Documentable

False

Rule Version

MD7X-00-003800

Severity Override Guidance

MongoDB supports several authentication mechanisms, some of which store credentials on the MongoDB server.

If these mechanisms are in use, MongoDB's authSchemaVersion in the admin.system.version collection must be set to "5".

1. Validate that authenticationMechanisms is defined in config file (default location /etc/mongod.conf).

The MongoDB Configuration file should contain the similar to the following entry:

setParameter:
authenticationMechanisms: SCRAM-SHA-256

If the config file does not contain an authenticationMechanisms entry, that is a finding.

2. Validate authSchemaVersion is set to "5".

Using the shell, run the following command:

> db.getSiblingDB("admin").system.version.find({ "_id" : "authSchema"}, {_id: 0})

It should return:

{ "currentVersion" : 5 }

If currentVersion is less than 5, this is a finding.

Check Content Reference

M

Target Key

5637