STIGQter STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must reveal detailed error messages only to the information system security officer (ISSO), information system security manager (ISSM), system administrator (SA) and database administrator (DBA).

DISA Rule

SV-279368r1179271_rule

Vulnerability Number

V-279368

Group Title

SRG-APP-000267-DB-000163

Rule Version

MD8X-00-005900

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Edit the MongoDB configuration file (default location /etc/mongod.conf) and add the following parameter "redactClientLogData" in the security section of that file. Example:

security:
redactClientLogData: true

Restart the MongoDB service from the OS.

$ sudo systemctl restart mongod

Identify and remove all unnecessary roles and privileges from application users.

Check Contents

A mongod or mongos running with "security.redactClientLogData:true" redacts any message accompanying a given log event before logging.

This prevents the mongod or mongos from writing potentially sensitive data stored on the database to the diagnostic log. Metadata such as error or operation codes, line numbers, and source file names are still visible in the logs.

To prevent too much information being displayed in the MongoDB logfiles, run the following command:
> db.getSiblingDB("admin").runCommand({getCmdLineOpts: 1}).parsed.security.redactClientLogData

If the command does not return true, this is a finding.

The MongoDB command "getLog" will return data from the log file, which requires the "getLog" action type on the cluster resource.

Ensure that application users are not authorized to execute this command.

To validate this run the following command on the name of the application user to view actions its permitted to perform on the cluster resource:

> db.runCommand({usersInfo: "<USER NAME>", showPrivileges: 1}).users[0].inheritedPrivileges.filter(privilege => privilege.resource.cluster)

If "getLog" appears in the list of actions, this is a finding.

Vulnerability Number

V-279368

Documentable

False

Rule Version

MD8X-00-005900

Severity Override Guidance

A mongod or mongos running with "security.redactClientLogData:true" redacts any message accompanying a given log event before logging.

This prevents the mongod or mongos from writing potentially sensitive data stored on the database to the diagnostic log. Metadata such as error or operation codes, line numbers, and source file names are still visible in the logs.

To prevent too much information being displayed in the MongoDB logfiles, run the following command:
> db.getSiblingDB("admin").runCommand({getCmdLineOpts: 1}).parsed.security.redactClientLogData

If the command does not return true, this is a finding.

The MongoDB command "getLog" will return data from the log file, which requires the "getLog" action type on the cluster resource.

Ensure that application users are not authorized to execute this command.

To validate this run the following command on the name of the application user to view actions its permitted to perform on the cluster resource:

> db.runCommand({usersInfo: "<USER NAME>", showPrivileges: 1}).users[0].inheritedPrivileges.filter(privilege => privilege.resource.cluster)

If "getLog" appears in the list of actions, this is a finding.

Check Content Reference

M

Target Key

5728