STIGQter STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must enforce access restrictions associated with changes to the configuration of MongoDB or database(s).

DISA Rule

SV-279381r1179310_rule

Vulnerability Number

V-279381

Group Title

SRG-APP-000380-DB-000360

Rule Version

MD8X-00-007400

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Locate a machine that can access the MongoDB Security Checklist here: https://www.mongodb.com/docs/v8.0/administration/security-checklist/

Review the MongoDB Security Checklist.

Follow the procedures to enable MongoDB access control here: https://www.mongodb.com/docs/v8.0/tutorial/enable-authentication/#enable-access-control

Check Contents

To verify that authentication and role-based access controls (RBAC) are configured correctly and restrictions are being enforced, create a test user and a custom role, and then confirm expected operations:

Once authenticated as a database administrator, use db.createUser() to create an additional user.

The following operation adds a user "myTester" to the test database who has read-only access on the test database:

> use test
> db.createUser(
{
user: "myTester", pwd: < password > ,
roles: [
{ role: "read", db: "test" }
]
}
)

Log out and then back in as the "test" database user. Issue the following to attempt to write to the test database with a read-only privilege:

> use test
> db.testCollection.insertOne( { x: 1 } )

This operation will fail with an error similar to the following:

"MongoServerError":"not authorized on test to execute command"{
"insert":"testCollection",
"documents":[
{
"x":1,
"_id":"ObjectId("6500b96d1114d3a3ba7dda39")"
}
],
"ordered":true,
"lsid":{
"id":"UUID("6cb3b9af-1ddc-446c-b0e0-bc9bf22807fa")"
},
"$db":"test"
}

If the operation does not fail, this is a finding.

Vulnerability Number

V-279381

Documentable

False

Rule Version

MD8X-00-007400

Severity Override Guidance

To verify that authentication and role-based access controls (RBAC) are configured correctly and restrictions are being enforced, create a test user and a custom role, and then confirm expected operations:

Once authenticated as a database administrator, use db.createUser() to create an additional user.

The following operation adds a user "myTester" to the test database who has read-only access on the test database:

> use test
> db.createUser(
{
user: "myTester", pwd: < password > ,
roles: [
{ role: "read", db: "test" }
]
}
)

Log out and then back in as the "test" database user. Issue the following to attempt to write to the test database with a read-only privilege:

> use test
> db.testCollection.insertOne( { x: 1 } )

This operation will fail with an error similar to the following:

"MongoServerError":"not authorized on test to execute command"{
"insert":"testCollection",
"documents":[
{
"x":1,
"_id":"ObjectId("6500b96d1114d3a3ba7dda39")"
}
],
"ordered":true,
"lsid":{
"id":"UUID("6cb3b9af-1ddc-446c-b0e0-bc9bf22807fa")"
},
"$db":"test"
}

If the operation does not fail, this is a finding.

Check Content Reference

M

Target Key

5728