STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must, for password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.

DISA Rule

SV-279349r1179508_rule

Vulnerability Number

V-279349

Group Title

SRG-APP-000171-DB-000074

Rule Version

MD8X-00-003600

Severity

CAT I

CCI(s)

• CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.

Weight

10

Fix Recommendation

For each user that does not have SCRAM-SHA-256, run the following command:

use admin
db.runCommand({'updateUser':'<their username>',pwd: passwordPrompt() , mechanisms:['SCRAM-SHA-256']})

Check Contents

MongoDB supports the Salted Challenge Response Authentication Mechanism (SCRAM) as the default authentication mechanism for MongoDB.

Run the following script for database in the MongoDB system:

/// Connect to admin database
db = db.getSiblingDB('admin');

// Get all users without SCRAM-SHA-256
const allUsers = db.system.users.find().toArray();
const usersToUpgrade = allUsers.filter(user =>
!user.credentials || !user.credentials["SCRAM-SHA-256"]
);

print(`Found ${usersToUpgrade.length} users without SCRAM-SHA-256 authentication`);

if (usersToUpgrade.length === 0) {
print("All users already using SCRAM-SHA-256. No action needed.");
quit();
}

// Display users that need upgrading
print("\nUsers needing upgrade to SCRAM-SHA-256:");
usersToUpgrade.forEach(user => {
print(`- User: ${user.user}, Database: ${user.db}`);
});

If any user found in a database using password authentication does not have "Using SCRAM-SHA-256: YES", this is a finding.

Vulnerability Number

V-279349

Documentable

False

Rule Version

MD8X-00-003600

Severity Override Guidance

MongoDB supports the Salted Challenge Response Authentication Mechanism (SCRAM) as the default authentication mechanism for MongoDB.

Run the following script for database in the MongoDB system:

/// Connect to admin database
db = db.getSiblingDB('admin');

// Get all users without SCRAM-SHA-256
const allUsers = db.system.users.find().toArray();
const usersToUpgrade = allUsers.filter(user =>
!user.credentials || !user.credentials["SCRAM-SHA-256"]
);

print(`Found ${usersToUpgrade.length} users without SCRAM-SHA-256 authentication`);

if (usersToUpgrade.length === 0) {
print("All users already using SCRAM-SHA-256. No action needed.");
quit();
}

// Display users that need upgrading
print("\nUsers needing upgrade to SCRAM-SHA-256:");
usersToUpgrade.forEach(user => {
print(`- User: ${user.user}, Database: ${user.db}`);
});

If any user found in a database using password authentication does not have "Using SCRAM-SHA-256: YES", this is a finding.

Check Content Reference

M

Target Key

5728