STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must provide nonprivileged users with error messages that provide information necessary for corrective actions without revealing information that could be exploited by adversaries.

DISA Rule

SV-279367r1179513_rule

Vulnerability Number

V-279367

Group Title

SRG-APP-000266-DB-000162

Rule Version

MD8X-00-005800

Severity

CAT II

CCI(s)

• CCI-001312 - Generates error messages that provide information necessary for corrective actions without revealing information that could be exploited.

Weight

10

Fix Recommendation

Configure custom application code so as not to divulge sensitive information or information useful for system identification in custom application error messages.

To configure MongoDB to redact client information from its log file, edit the MongoDB configuration file (default location /etc/mongod.conf).

Add the following option to the security section:

security:
redactClientLogData: true

Restart the MongoDB server from the operating system:

$ sudo systemctl restart mongod

Check Contents

Check custom application code to verify error messages do not contain information beyond what is needed for troubleshooting the issue.

If custom application error messages contain PII data, sensitive business data, or information useful for identifying the host system or database structure, this is a finding.

For example, when attempting to log in using the MongoDB shell with incorrect client credentials, the user will receive a generic error message that the authentication failed regardless of whether the user exists.

If a user is attempting to perform an operation using the MongoDB shell for which they do not have privileges, MongoDB will return a generic error message that the operation is not authorized.

To prevent too much information being displayed in the MongoDB logfiles, run the following command:

> db.getSiblingDB("admin").runCommand({getCmdLineOpts: 1}).parsed.security.redactClientLogData

If the command does not return true, this is a finding.

Vulnerability Number

V-279367

Documentable

False

Rule Version

MD8X-00-005800

Severity Override Guidance

Check custom application code to verify error messages do not contain information beyond what is needed for troubleshooting the issue.

If custom application error messages contain PII data, sensitive business data, or information useful for identifying the host system or database structure, this is a finding.

For example, when attempting to log in using the MongoDB shell with incorrect client credentials, the user will receive a generic error message that the authentication failed regardless of whether the user exists.

If a user is attempting to perform an operation using the MongoDB shell for which they do not have privileges, MongoDB will return a generic error message that the operation is not authorized.

To prevent too much information being displayed in the MongoDB logfiles, run the following command:

> db.getSiblingDB("admin").runCommand({getCmdLineOpts: 1}).parsed.security.redactClientLogData

If the command does not return true, this is a finding.

Check Content Reference

M

Target Key

5728