STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must be configured to prohibit or restrict the use of organization-defined functions, ports, protocols, and/or services, as defined in the PPSM CAL and vulnerability assessments.

DISA Rule

SV-279346r1179449_rule

Vulnerability Number

V-279346

Group Title

SRG-APP-000142-DB-000094

Rule Version

MD8X-00-003300

Severity

CAT II

CCI(s)

CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

Fix Recommendation

Check the MongoDB configuration file (default location /etc/mongod.conf):

Ensure the following section exists and set the port in the to an allowed port:

net:
port: 27017

Ensure that TLS 1.2+ is being used by adding the following entry into the configuration file.

net:
tls:
mode: requireTLS
disabledProtocols: TLS1_0,TLS1_1

Ensure the following section exists in the configuration file and that it does not contain wildcard binding (occurrences of "0.0.0.0" or "::0" or equivalents).

net:
bindIp: 127.0.0.1,<specific-ip-addresses>

Check Contents

Check the MongoDB configuration file (default location /etc/mongod.conf) to verify the following entry:

net:
port: 27017

If the port listed is not authorized, this is a finding.

Verify only TLS 1.2+ is being used. If the following entry is not in the configuration file, this is a finding.

net:
tls:
mode: requireTLS
disabledProtocols: TLS1_0,TLS1_1

Verify the binding of IP addresses does not include "0.0.0.0" or ":0":

net:
bindIp: 127.0.0.1,<specific-ip-addresses>

If the bindIp contains "0.0.0.0" or "::0", this is a finding.

Vulnerability Number

V-279346

Documentable

False

Rule Version

MD8X-00-003300

Severity Override Guidance

Check Content Reference

Target Key

5728