STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

MongoDB must enforce discretionary access control (DAC) policies, as defined by the data owner, over defined subjects and objects.

DISA Rule

SV-265935r1031272_rule

Vulnerability Number

V-265935

Group Title

SRG-APP-000328-DB-000301

Rule Version

MD7X-00-006700

Severity

CAT II

CCI(s)

CCI-002165 - Enforce organization-defined discretionary access control policies over defined subjects and objects.

Weight

Fix Recommendation

Enable authentication for MongoDB by following the instructions here: https://www.mongodb.com/docs/v7.0/tutorial/enable-authentication/

Create an administrative user in MongoDB:

use admin
db.createUser(
{
user: "UserAdmin",
pwd: passwordPrompt(), // or cleartext password
roles: [
{ role: "userAdminAnyDatabase", db: "admin" },
{ role: "readWriteAnyDatabase", db: "admin" }
]
}
)

Enable authorization by adding the following entry to the MongoDB configuration file:

security:
authorization: enabled

Restart the MongoDB service from the OS.

$ sudo systemctl restart mongod

The "UserAdmin" user created above can use the "createUser" and "createRole" MongoDB commands to add the required users and roles per organizational- or site-specific documentation.

https://www.mongodb.com/docs/v7.0/reference/command/createUser/

https://www.mongodb.com/docs/v7.0/reference/command/createRole/

Check Contents

Review the MongoDB Configuration file (default location: /etc/mongod.conf).

If the file does not contain the following entry, this is a finding:

security:
authorization: enabled

Vulnerability Number

V-265935

Documentable

False

Rule Version

MD7X-00-006700

Severity Override Guidance

Review the MongoDB Configuration file (default location: /etc/mongod.conf).

If the file does not contain the following entry, this is a finding:

security:
authorization: enabled

Check Content Reference

Target Key

5637