STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

MongoDB must provide nonprivileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

DISA Rule

SV-265931r1028807_rule

Vulnerability Number

V-265931

Group Title

SRG-APP-000266-DB-000162

Rule Version

MD7X-00-006000

Severity

CAT II

CCI(s)

• CCI-001312 - Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited.

Weight

10

Fix Recommendation

Configure custom application code so as not to divulge sensitive information or information useful for system identification in custom application error messages.

To configure MongoDB to redact client information from its log file, do the following:

Edit the MongoDB Configuration file (default location: /etc/mongod.conf)

Add the following option to the security section:

security:
redactClientLogData: true

Restart the MongoDB server from the operating system:

$ sudo systemctl restart mongod

Check Contents

Check custom application code to verify that error messages do not contain information beyond what is needed for troubleshooting the issue.

If custom application error messages contain PII data, sensitive business data, or information useful for identifying the host system or database structure, this is a finding.

For example, when attempting to log in using the MongoDB shell with incorrect client credentials, the user will receive a generic error message that the authentication failed regardless of whether the user exists.

If a user is attempting to perform an operation using the MongoDB shell for which they do not have privileges, MongoDB will return a generic error message that the operation is not authorized.

To prevent too much information being displayed in the MongoDB logfiles, run the following command:

> db.getSiblingDB("admin").runCommand({getCmdLineOpts: 1}).parsed.security.redactClientLogData

If the command does not return true, this is a finding.

Vulnerability Number

V-265931

Documentable

False

Rule Version

MD7X-00-006000

Severity Override Guidance

Check custom application code to verify that error messages do not contain information beyond what is needed for troubleshooting the issue.

If custom application error messages contain PII data, sensitive business data, or information useful for identifying the host system or database structure, this is a finding.

For example, when attempting to log in using the MongoDB shell with incorrect client credentials, the user will receive a generic error message that the authentication failed regardless of whether the user exists.

If a user is attempting to perform an operation using the MongoDB shell for which they do not have privileges, MongoDB will return a generic error message that the operation is not authorized.

To prevent too much information being displayed in the MongoDB logfiles, run the following command:

> db.getSiblingDB("admin").runCommand({getCmdLineOpts: 1}).parsed.security.redactClientLogData

If the command does not return true, this is a finding.

Check Content Reference

M

Target Key

5637