STIGQter STIGQter: STIG Summary: MongoDB Enterprise Advanced 7.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).

DISA Rule

SV-265942r1028817_rule

Vulnerability Number

V-265942

Group Title

SRG-APP-000380-DB-000360

Rule Version

MD7X-00-007800

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Locate a machine that can access the MongoDB Security Checklist here: https://www.mongodb.com/docs/v7.0/administration/security-checklist/

Review the MongoDB Security Checklist.

Follow the procedures to enable MongoDB access control here: https://www.mongodb.com/docs/v7.0/tutorial/enable-authentication/#enable-access-control

Check Contents

To verify that authentication and Role-Based Access Controls (RBAC) is configured correctly and restrictions are being enforced, create a test user and a custom role, and then confirm expected operations:

Once authenticated as a DBA administrator, use db.createUser() to create an additional user.

The following operation adds a user "myTester" to the test database who has read-only access on the test database:

> use test
> db.createUser(
{
user: "myTester", pwd: <password>,
roles: [
{ role: "read", db: "test" }
]
}
)

Log out and then back in as the "test" database user. Issue the following to attempt to write to the test database with a read-only privilege:

> use test
> db.testCollection.insertOne( { x: 1 } )

This operation will fail with an error similar to the following:

"MongoServerError":"not authorized on test to execute command"{
"insert":"testCollection",
"documents":[
{
"x":1,
"_id":"ObjectId(""6500b96d1114d3a3ba7dda39"")"
}
],
"ordered":true,
"lsid":{
"id":"UUID(""6cb3b9af-1ddc-446c-b0e0-bc9bf22807fa"")"
},
"$db":"test"
}

If the operation does not fail, this is a finding.

Vulnerability Number

V-265942

Documentable

False

Rule Version

MD7X-00-007800

Severity Override Guidance

To verify that authentication and Role-Based Access Controls (RBAC) is configured correctly and restrictions are being enforced, create a test user and a custom role, and then confirm expected operations:

Once authenticated as a DBA administrator, use db.createUser() to create an additional user.

The following operation adds a user "myTester" to the test database who has read-only access on the test database:

> use test
> db.createUser(
{
user: "myTester", pwd: <password>,
roles: [
{ role: "read", db: "test" }
]
}
)

Log out and then back in as the "test" database user. Issue the following to attempt to write to the test database with a read-only privilege:

> use test
> db.testCollection.insertOne( { x: 1 } )

This operation will fail with an error similar to the following:

"MongoServerError":"not authorized on test to execute command"{
"insert":"testCollection",
"documents":[
{
"x":1,
"_id":"ObjectId(""6500b96d1114d3a3ba7dda39"")"
}
],
"ordered":true,
"lsid":{
"id":"UUID(""6cb3b9af-1ddc-446c-b0e0-bc9bf22807fa"")"
},
"$db":"test"
}

If the operation does not fail, this is a finding.

Check Content Reference

M

Target Key

5637