STIGQter: STIG Summary: MongoDB Enterprise Advanced 8.x Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Jan 2026:

MongoDB must require users to reauthenticate when organization-defined circumstances or situations require reauthentication.

DISA Rule

SV-279383r1179483_rule

Vulnerability Number

V-279383

Group Title

SRG-APP-000389-DB-000372

Rule Version

MD8X-00-007700

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Enable authentication for MongoDB by following the instructions here: https://www.mongodb.com/docs/v8.0/tutorial/enable-authentication/

Create an administrative user in MongoDB:

> use admin
> db.createUser(
{
user: "UserAdmin",
pwd: passwordPrompt(), // or cleartext password
roles: [
{ role: "userAdminAnyDatabase", db: "admin" },
{ role: "readWriteAnyDatabase", db: "admin" }
]
}
)

Enable authorization by adding the following entry to the MongoDB configuration file:

security:
authorization: enabled

Restart the MongoDB service from the OS.

$ sudo systemctl restart mongod

The "UserAdmin" user created above can use the "createUser" and "createRole" MongoDB commands to add the required users and roles per organizational or site-specific documentation.

More information can be found here:

https://www.mongodb.com/docs/v8.0/reference/command/createUser/

https://www.mongodb.com/docs/v8.0/reference/command/createRole/

Check Contents

In MongoDB, a user can reauthenticate by explicitly logging out and then logging back in with the db.logout() and db.auth() commands, respectively.

The steps to accomplish this would typically depend on the environment and interface, for example, shell, driver, or MongoDB Atlas.

Log out of the current session using the db.logout() command.

Run the following command from the database the user has authenticated from (example below uses "test" as the authentication database):

> use test
> db.logout()

Example output:

{ ok: 1 }

If the above output is not displayed upon logout, this is a finding.

Log back in, using the db.auth() command:

> use test
> db.auth({
user: '<username>',
pwd: '<password>'
})

Example output:

{ ok: 1 }

If the above output is not displayed upon login, this is a finding.

Vulnerability Number

V-279383

Documentable

False

Rule Version

MD8X-00-007700

Severity Override Guidance

In MongoDB, a user can reauthenticate by explicitly logging out and then logging back in with the db.logout() and db.auth() commands, respectively.

The steps to accomplish this would typically depend on the environment and interface, for example, shell, driver, or MongoDB Atlas.

Log out of the current session using the db.logout() command.

Run the following command from the database the user has authenticated from (example below uses "test" as the authentication database):

> use test
> db.logout()

Example output:

{ ok: 1 }

If the above output is not displayed upon logout, this is a finding.

Log back in, using the db.auth() command:

> use test
> db.auth({
user: '<username>',
pwd: '<password>'
})

Example output:

{ ok: 1 }

If the above output is not displayed upon login, this is a finding.

Check Content Reference

M

Target Key

5728