STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must enforce Discretionary Access Control (DAC) policies, as defined by the data owner, over defined subjects and objects.

DISA Rule

SV-279372r1179475_rule

Vulnerability Number

V-279372

Group Title

SRG-APP-000328-DB-000301

Rule Version

MD8X-00-006500

Severity

CAT II

CCI(s)

CCI-002165 - Enforce organization-defined discretionary access control policies over defined subjects and objects.

Weight

Fix Recommendation

Enable authentication for MongoDB by following the instructions here:
https://www.mongodb.com/docs/v8.0/tutorial/enable-authentication/

Create an administrative user in MongoDB:

use admin
db.createUser(
{
user: < username >,
pwd: < passwordPrompt() >, // or cleartext password
roles: [
{ role: "userAdminAnyDatabase", db: "admin" },
{ role: "readWriteAnyDatabase", db: "admin" }
]
}
)

Enable authorization by adding the following entry to the MongoDB configuration file:

security:
authorization: enabled

Restart the MongoDB service from the OS.

$ sudo systemctl restart mongod

The "UserAdmin" user created above can use the "createUser" and "createRole" MongoDB commands to add the required users and roles per organizational or site-specific documentation.

https://www.mongodb.com/docs/v8.0/reference/command/createUser/

https://www.mongodb.com/docs/v8.0/reference/command/createRole/

Check Contents

Review the MongoDB configuration file (default location /etc/mongod.conf).

If the file does not contain the following entry, this is a finding:

security:
authorization: enabled

Vulnerability Number

V-279372

Documentable

False

Rule Version

MD8X-00-006500

Severity Override Guidance

Review the MongoDB configuration file (default location /etc/mongod.conf).

If the file does not contain the following entry, this is a finding:

security:
authorization: enabled

Check Content Reference

Target Key

5728